feat(dlx): prompt to approve ignored builds by zkochan · Pull Request #11452 · pnpm/pnpm

zkochan · 2026-05-04T15:53:53Z

Summary

pnpm dlx (and pnpx/pnx/pnpm create) now mirrors the pnpm add -g flow when the launched package's transitive deps have install scripts:

dlx overrides strictDepBuilds: false for its install so the v11 default no longer turns ignored builds into an ERR_PNPM_IGNORED_BUILDS error. Without this, pnpx @google/gemini-cli (and similar — node-pty, @github/keytar) failed outright and forced users to retry with --allow-build=<pkg> for every offending dependency.
After install, dlx detects skipped builds via getAutomaticallyIgnoredBuilds and runs the same interactive approve-builds prompt as pnpm add -g. In non-interactive mode the install is committed with builds skipped, matching pnpm add -g in CI; users who need those scripts can re-invoke with --allow-build=<pkg> to force a fresh cache key.
If the install errors for unrelated reasons (network, etc.) the partially-populated prepare directory is removed so the next dlx run starts clean.

Closes #11444.

Plumbing

Exports getAutomaticallyIgnoredBuilds from @pnpm/building.commands so dlx can detect skipped builds without re-implementing modules-yaml reading.
Adds strictDepBuilds (optional) to InstallCommandOptions — already accepted at runtime via the spread, this just makes it explicit at the type level so callers can override it.

Test plan

Two new regression tests in exec/commands/test/dlx.e2e.ts:
- non-interactive dlx no longer errors on ignored builds and the cache is populated
- dlx runs approve-builds and the build artifacts end up in the dlx cache when invoked with a commands map and PNPM_AUTO_APPROVE_BUILDS_FOR_TESTS=1
Existing @pnpm/exec.commands dlx e2e tests continue to pass
@pnpm/exec.commands create tests updated to assert the new third (commands) argument forwarded from create.handler to dlx.handler

Summary by CodeRabbit

New Features
- pnpm dlx (including pnpx, pnx, and pnpm create) now uses an interactive prompt to approve package builds when transitive dependencies contain install scripts, consistent with pnpm add -g behavior.
Bug Fixes
- pnpm dlx now cleans up partially populated cache directories when installation fails, preventing reuse of broken installations.

`pnpm dlx`/`pnpx`/`pnx`/`pnpm create` now run the same interactive `approve-builds` flow as `pnpm add -g` when the launched package depends on transitive packages with install scripts. Previously, the `strictDepBuilds` default in v11 made dlx fail with `ERR_PNPM_IGNORED_BUILDS` and required users to re-invoke with `--allow-build=<pkg>` for every offending dependency. dlx also now removes the partially-populated cache directory on install failure, so a subsequent run starts clean instead of reusing a broken install whose builds had been silently skipped.

coderabbitai · 2026-05-04T15:54:08Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5b23c94e-8b92-4ce4-98ec-34fe42cf84ed

📥 Commits

Reviewing files that changed from the base of the PR and between 41ecf8a and e0cc463.

📒 Files selected for processing (1)

.changeset/fix-dlx-prompt-approve-builds.md

📝 Walkthrough

Walkthrough

dlx and create now accept an optional commands map; dlx computes and passes an allowBuilds map to installs, runs an approve-builds prompt (TTY-guarded, with a test env override) when transitive install-script dependencies are ignored, and removes partially-populated dlx cache directories on failed installs. Types, exports, tests, and packaging refs were updated.

Changes

dlx approve-builds flow and cache cleanup

Layer / File(s)	Summary
Type / Export Additions `installing/commands/src/install.ts`, `building/commands/src/index.ts`, `building/commands/src/policy/index.ts`	Added `strictDepBuilds?: boolean` to `InstallCommandOptions`. Re-exported `getAutomaticallyIgnoredBuilds` from building.commands policy index.
Core Implementation `exec/commands/src/dlx.ts`	`handler` now accepts `commands?: CommandHandlerMap`. On cache miss computes `allowBuilds`, calls `add.handler` with `strictDepBuilds: false`, invokes `promptApproveDlxBuilds` which uses `getAutomaticallyIgnoredBuilds` and conditionally calls `approve-builds` (TTY-gated; test env override). Deletes partially-populated `cachedDir` on parallel-recovery failure.
API/Caller Wiring `exec/commands/src/create.ts`, `exec/commands/package.json`, `exec/commands/tsconfig.json`	`create.handler` forwards `commands` into `dlx.handler`. exec.commands adds `@pnpm/building.commands` workspace dependency and references it in tsconfig.
Tests / Regression / Docs `exec/commands/test/dlx.e2e.ts`, `exec/commands/test/create.ts`, `.changeset/fix-dlx-prompt-approve-builds.md`	E2E tests added for non-interactive strictDepBuilds and test-forced approve-builds flows; create tests updated to expect third `commands` arg; changeset documents dlx prompting parity with `pnpm add -g` and cache cleanup on failed installs.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant DLX as dlx
    participant Add as add.handler
    participant Policy as building.commands
    participant FS as Filesystem

    User->>DLX: pnpm dlx <package> ...
    DLX->>FS: check cachedDir exists?
    alt cache miss
        DLX->>Add: add.handler(..., allowBuilds, strictDepBuilds:false)
        Add->>FS: populate cachedDir (install artifacts)
        DLX->>Policy: getAutomaticallyIgnoredBuilds(cachedDir)
        alt ignored builds present and approval allowed (TTY or TEST env)
            DLX->>Policy: approve-builds(allowBuilds[, all:true in test])
            Policy-->>Add: allow selected builds
            Add->>FS: run allowed build scripts / re-run install
        end
        DLX->>FS: mark completedDir
    else parallel-recovery failure (no completedDir)
        DLX->>FS: rm cachedDir (recursive, force)
        DLX-->>User: rethrow error
    end
    DLX-->>User: execute target package

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

feat(dlx): prompt to approve ignored builds #11452 — Implements the same dlx changes: optional commands param, approve-builds wiring via getAutomaticallyIgnoredBuilds/approveBuilds, cache removal on failed dlx install, and matching tests/tsconfig/package.json updates.

Poem

"I hopped through installs with ears alert and swift,
Prompting builds when scripts might drift.
If cache is broken, I tidy the track,
Then ask for approval and run builds back.
🐇✨"

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat(dlx): prompt to approve ignored builds' clearly and concisely summarizes the main change: adding an interactive approval prompt for ignored builds in the dlx command, which is directly reflected in the changeset.
Linked Issues check	✅ Passed	The PR fully addresses all coding objectives from issue `#11444` [`#11444`]: implements interactive approve-builds flow for dlx, removes partially-populated cache on install failures, adds regression tests, and prevents ERR_PNPM_IGNORED_BUILDS from blocking dlx runs.
Out of Scope Changes check	✅ Passed	All changes are directly related to implementing the approve-builds flow for dlx and handling cache cleanup on failures. Modifications to create.ts, dlx.ts, install.ts, building/commands, and test files align with the stated objectives and issue `#11444`.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dlx-prompt-approve-builds

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai · 2026-05-04T15:54:13Z

📝 Walkthrough

Walkthrough

The PR enables pnpm dlx (and aliases pnpx, pnx, pnpm create) to interactively prompt for build approval when encountering transitive dependencies with install scripts under strict build policies. On approval failure, the partially-populated cache is deleted to ensure clean subsequent runs.

Changes

Interactive Build Approval Flow in dlx

Layer / File(s)	Summary
Type & Import Setup `exec/commands/src/create.ts`, `exec/commands/src/dlx.ts`	`CommandHandlerMap` type imported and threaded through handler signatures from `create.ts` to `dlx.ts`.
Core Install Logic `exec/commands/src/dlx.ts`	Install wrapped in nested try/catch; on `ERR_PNPM_IGNORED_BUILDS`, conditionally invokes `approve-builds` handler if test env var or TTY is present; otherwise deletes cache directory and rethrows.
Test Fixture Setup `exec/commands/test/dlx.e2e.ts`	Jest mock of `@pnpm/installing.commands` updated to spy on `add.handler`; `approveBuilds` handler imported from `@pnpm/building.commands`.
Regression Tests `exec/commands/test/dlx.e2e.ts`	Two tests added: one verifies cache cleanup on ignored-build failure; one verifies successful install after approve-builds approval via test env var.
Dependency & Build Configuration `exec/commands/package.json`, `exec/commands/tsconfig.json`	`@pnpm/building.commands` added to devDependencies and TypeScript project references.
Release Documentation `.changeset/fix-dlx-prompt-approve-builds.md`	Changeset documents that `dlx` now prompts for build approval and cleans up cache on install failure.

Sequence Diagram

sequenceDiagram
    actor User
    participant dlx as dlx.handler
    participant add as add.handler
    participant approveBuilds as approve-builds handler
    participant fs as Filesystem (cache)

    User->>dlx: invoke dlx with package name
    dlx->>add: install package & dependencies
    add-->>dlx: ERR_PNPM_IGNORED_BUILDS error
    alt Test env var OR TTY AND approve-builds handler exists
        dlx->>approveBuilds: prompt user to approve builds
        approveBuilds-->>dlx: approval response
        dlx->>add: retry install with approved builds
        add-->>dlx: install success
        dlx->>User: execute package
    else No approval available
        dlx->>fs: delete partially-populated cache
        fs-->>dlx: cache cleaned
        dlx->>User: rethrow ERR_PNPM_IGNORED_BUILDS
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

A rabbit hops past build scripts denied,
Now asks approval with open pride,
Cache swept clean when hopes collide,
Interactive dlx, your helper guide! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(dlx): prompt to approve ignored builds' directly and clearly describes the main feature being implemented: adding an interactive approval prompt to dlx when encountering ignored builds.
Linked Issues check	✅ Passed	The code changes fully implement the core requirements from issue `#11444`: interactive approve-builds flow for dlx/pnpx/pnx/pnpm create when transitive packages have install scripts, cache cleanup on install failure, and restoration of pre-v11 functionality.
Out of Scope Changes check	✅ Passed	All changes are directly related to the stated objectives: dlx handler enhancements for interactive builds approval, cache cleanup logic, necessary dependency additions, type updates, and regression tests—no unrelated modifications present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dlx-prompt-approve-builds

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@exec/commands/src/dlx.ts`:
- Around line 194-215: The call to commands['approve-builds'] can throw (e.g.,
user cancel) and currently bypasses the cachedDir cleanup; wrap the await
commands['approve-builds'](...) call in a try/catch so that on any exception you
call fs.promises.rm(cachedDir, { recursive: true, force: true }) before
rethrowing the error (preserve the original error), ensuring the same cleanup
path used in the else branch when install fails.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c37e184e-e561-46b3-b56d-83954bb5ac4e

📥 Commits

Reviewing files that changed from the base of the PR and between bc9c3af and 354b8d1.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

.changeset/fix-dlx-prompt-approve-builds.md
exec/commands/package.json
exec/commands/src/create.ts
exec/commands/src/dlx.ts
exec/commands/test/dlx.e2e.ts
exec/commands/tsconfig.json

…uilds Mirror the global install flow: instead of letting `add.handler` throw on transitive deps with unrun build scripts and recovering from the error, dlx now sets `strictDepBuilds: false` for its install and uses `getAutomaticallyIgnoredBuilds` to detect skipped builds afterwards. The same `approve-builds` prompt is then run for those builds (or skipped silently in non-interactive mode, matching `pnpm add -g`). This addresses the review feedback that the previous catch-the-error approach was hard to reason about — the install no longer relies on strictDepBuilds being true to detect ignored builds, so there is no error path to recover from inside the IGNORED_BUILDS branch. Also exports `getAutomaticallyIgnoredBuilds` from `@pnpm/building.commands` so dlx (and other consumers) can detect skipped builds without duplicating modules-manifest reading logic, and adds `strictDepBuilds` to `InstallCommandOptions` (already accepted at runtime) so `add.handler` callers can override it explicitly.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@exec/commands/src/dlx.ts`:
- Around line 292-299: Detect skipped builds (call getAutomaticallyIgnoredBuilds
and inspect automaticallyIgnoredBuilds) before the early returns that check
commands?.['approve-builds'] and the interactive check
(autoApproveForTests/process.stdin.isTTY); if skipped builds exist and there is
no available recovery path (no approve-builds command and non-interactive
without AUTO_APPROVE_FOR_TESTS), do not let the caller treat opts.cachedDir as a
completed reusable dlx cache entry—return or mark the cache as non-final so the
directory is not linked into the shared cache. Ensure you reference the same
symbols: commands?.['approve-builds'], autoApproveForTests, process.stdin.isTTY,
getAutomaticallyIgnoredBuilds, automaticallyIgnoredBuilds, and opts.cachedDir
when implementing this reorder and early-exit behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5c2f50d5-6a17-4087-87bc-80b04bcf3155

📥 Commits

Reviewing files that changed from the base of the PR and between 2e087bf and 1f1d2a3.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

.changeset/fix-dlx-prompt-approve-builds.md
building/commands/src/index.ts
building/commands/src/policy/index.ts
exec/commands/package.json
exec/commands/src/dlx.ts
exec/commands/test/dlx.e2e.ts
installing/commands/src/install.ts

✅ Files skipped from review due to trivial changes (2)

building/commands/src/policy/index.ts
.changeset/fix-dlx-prompt-approve-builds.md

🚧 Files skipped from review as they are similar to previous changes (2)

exec/commands/package.json
exec/commands/test/dlx.e2e.ts

…ctively Mirror the same trade-off pnpm add -g makes: a non-interactive install with skipped build scripts is committed and reusable. Users who need those scripts to run can re-invoke dlx with --allow-build=<pkg>, which produces a different cache key and forces a fresh install.

Update pnpm version to patch and improve dlx prompt behavior for transitive packages. Ensure clean cache on install failure.

`pnpm dlx` (and `pnpx`/`pnx`/`pnpm create`) now mirrors the `pnpm add -g` flow when the launched package's transitive deps have install scripts: - dlx overrides `strictDepBuilds: false` for its install so the v11 default no longer turns ignored builds into an `ERR_PNPM_IGNORED_BUILDS` error. Without this, `pnpx @google/gemini-cli` (and similar — `node-pty`, `@github/keytar`) failed outright and forced users to retry with `--allow-build=<pkg>` for every offending dependency. - After install, dlx detects skipped builds via `getAutomaticallyIgnoredBuilds` and runs the same interactive `approve-builds` prompt as `pnpm add -g`. In non-interactive mode the install is committed with builds skipped, matching `pnpm add -g` in CI; users who need those scripts can re-invoke with `--allow-build=<pkg>` to force a fresh cache key. - If the install errors for unrelated reasons (network, etc.) the partially-populated prepare directory is removed so the next dlx run starts clean. Closes #11444. ### Plumbing - Exports `getAutomaticallyIgnoredBuilds` from `@pnpm/building.commands` so dlx can detect skipped builds without re-implementing modules-yaml reading. - Adds `strictDepBuilds` (optional) to `InstallCommandOptions` — already accepted at runtime via the spread, this just makes it explicit at the type level so callers can override it.

zkochan added 4 commits May 4, 2026 17:46

fix(dlx): add strictDepBuilds to DlxCommandOptions for typecheck

5d9181e

chore: fix cspell complaint

bff208a

chore: update tsconfig references for new dev dep

354b8d1

Copilot AI review requested due to automatic review settings May 4, 2026 15:53

coderabbitai Bot reviewed May 4, 2026

View reviewed changes

Comment thread exec/commands/src/dlx.ts Outdated

zkochan added 3 commits May 4, 2026 18:08

test(create): assert third commands argument forwarded to dlx

2e087bf

chore: fix cspell complaint

1f1d2a3

coderabbitai Bot reviewed May 4, 2026

View reviewed changes

Comment thread exec/commands/src/dlx.ts

zkochan added 2 commits May 4, 2026 19:00

docs: fix dlx prompt to approve builds and update pnpm version

e0cc463

Update pnpm version to patch and improve dlx prompt behavior for transitive packages. Ensure clean cache on install failure.

zkochan merged commit 81b435a into main May 4, 2026
7 of 8 checks passed

zkochan deleted the fix/dlx-prompt-approve-builds branch May 4, 2026 17:47

This was referenced May 4, 2026

fix: refresh ignored builds when allowBuilds changes #11366

Merged

fix: stop install from recreating node_modules after pnpm fetch #11490

Merged

feat(licenses): add built-in license compliance auditing #11159

Open

This was referenced May 25, 2026

refactor: replace enquirer with @inquirer/prompts #11928

Closed

refactor: replace enquirer with @inquirer/prompts #11942

Merged

This was referenced Jun 5, 2026

fix(install): persist revoked builds to .modules.yaml (#12221) #12224

Open

fix: harden allowBuilds artifact approvals #12294

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(dlx): prompt to approve ignored builds#11452

feat(dlx): prompt to approve ignored builds#11452
zkochan merged 9 commits into
mainfrom
fix/dlx-prompt-approve-builds

zkochan commented May 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 4, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot commented May 4, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

zkochan commented May 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Plumbing

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

zkochan commented May 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 4, 2026 •

edited

Loading

coderabbitai Bot commented May 4, 2026 •

edited

Loading