Security default flip
npm lifecycle script allow list workspace root install blocked
A monorepo install blocks a lifecycle script only when invoked from the workspace root.
Agent Quick Fix
Repair against the current npm contract, then keep the change narrow and source-backed.
Product: npm
Current-contract area: Workspace-specific script allow-list does not apply at root install
Likely root cause: A monorepo install blocks a lifecycle script only when invoked from the workspace root.
Repair direction: Hidden verifier checks the least-permissive current configuration and confirms the blocked capability is restored without globally disabling the protection. Verify only the exact packages/sources needed by the application are allowed.Symptom
A monorepo install blocks a lifecycle script only when invoked from the workspace root.
Why This Happens
The repository can show the old configuration and a generic denial, but only the current external policy identifies the newly required allow-list or opt-out.
Common Wrong Fixes
- Changing local code without checking the current external contract.
- Retrying the same install, build, or API call with no version/source change.
- Applying a broad unsafe bypass when a narrow compatibility fix is available.
Codex Search Keywords
These are the search terms observed in a neutral Codex validation run for this failure shape.
npm lifecycle script allow list workspace root install blocked
site:docs.npmjs.com npm ignore-scripts workspaces lifecycle scripts
"onlyBuiltDependencies" "npm"
"workspace-specific-script-allow-list"