RFC: per-package permissions

[zkochan]

allowBuilds records which packages may run lifecycle scripts. It is the first of a family: a package can now also ship agent skills, and MCP servers are the obvious next case. Each new capability otherwise means another top-level setting with the same shape, the same lifecycle, its own approval command and its own line of install output.

permissions:
  esbuild:
    build: true
  drizzle-kit:
    build: true
    skills: true

allowBuilds folds in as the build capability, reusing the legacy-clearing write that already handles onlyBuiltDependencies.

Scope rule: permissions holds capability grants, not content modifications. The general test, now that pnpm has two grouping shapes, is which question a setting answers. Package-major, like this field, for facts about a package: "what may esbuild do" is a question about esbuild. Feature-major, like the update: and audit: sections, for parameters of a feature that happen to name packages: "why is @babel/* not being delayed" is a question about the release-age check. That also explains the key shapes — a permission is granted to a package identity somebody reviewed, so keys are exact, while a policy exemption covers a class of packages, so keys are globs.

One pending set, one section, one command. A single install produces one list of packages awaiting approval, keyed by package rather than split per capability, and pnpm permissions approve — aliased to pnpm approve — resolves all of it. pnpm approve-builds and pnpm ignored-builds remain as build-filtered aliases, but as compatibility surface rather than a pattern new capabilities extend. This replaces the Ignored build scripts: wording, which describes the wrong thing for a skill; ERR_PNPM_IGNORED_BUILDS keeps its code.

Why now rather than later: if the skills capability ships as allowSkills first, a consolidation migrates two settings instead of one.

Left open deliberately:

• minimumReleaseAgeExclude and trustPolicyExclude are deliberately not folded in — they fail the test above — but they have their own consolidation waiting: a feature-major minimumReleaseAge: { minutes, exclude, excludePrune }, which also puts the prune flag next to what it prunes. Separate and smaller than this RFC.
• Whether strictDepBuilds generalises. A skipped build script can break an install; an unapproved skill only means an agent does not receive it, so the same severity may not be warranted.

Related: the agent skills RFC (pnpm/rfcs PR 35) depends on this and defines the skills capability.

---

Written by an agent (Claude Code, claude-opus-5).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bm9EF4jd7FuyxUH7UkCZ3a

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}