namespace the install-script approval commands

[JamieMagee]

Follow-up from RFC #868 (make install scripts opt-in), tracking the command-naming discussion at npm/rfcs#868 (comment).

Background

npm v11.16.0 shipped two top-level commands, npm approve-scripts and npm deny-scripts. Both are thin subclasses of lib/utils/allow-scripts-cmd.js, registered in lib/utils/cmd-list.js. The verb-noun shape came from pnpm (pnpm approve-builds), and it doesn't match how npm normally groups related operations: npm cache <cmd>, npm team <cmd>, npm token <cmd>, npm org <cmd>.

Proposal

Add one namespaced command and keep the verb-noun forms as aliases (they've shipped, so this stays backwards compatible):

• npm install-scripts approve <pkg>... | --all
• npm install-scripts deny <pkg>...
• npm install-scripts ls (list unreviewed; see companion issue)
• npm approve-scripts / npm deny-scripts alias to the above

Names raised in the thread:

• npm install-scripts (favoured by @bakkot)
• npm scripts (rejected: clashes with the scripts block and npm run)
• npm trust (rejected: npm trust already exists)
• npm hooks, npm lifecycle

@owlstronaut suggested aliasing the current commands and adding the namespace in Phase 2.

Notes

• install-scripts says what it does, so it's the strongest candidate.
• A namespace also gives the pending listing a home (install-scripts ls), which removes the --allow-scripts-pending ambiguity (companion issue).
• The native-dependency-patching RFC (#804 #862) made the same move from verb-noun commands to subcommands; keeping these consistent is worth it.
• No RFC needed. The command surface is additive and can be re-aliased later.

[manzoorwanijk]

Thinking more about the naming, I wonder whether npm scripts is still the best name for this. The reason is that npm install-scripts reads imperative, just like allow-remote, allow-scripts, npm install, etc., the correct noun based name should ideally be npm installation-scripts, but that doesn't sound exciting. 😄

npm scripts approve and npm scripts deny read better and, IMHO, represent what they actually deal with - "scripts (from dependencies)", just like --ignore-scripts (for all lifecycle scripts).

Otherwise, we could be even more explicit about what it means

• npm package-scripts allow/deny
• npm dependency-scripts approve/deny

That said, npm scripts is short and clear.

[manzoorwanijk]

I want to work on this. Can we please settle the naming?

CC: @owlstronaut

[JamieMagee]

Let's go with install-scripts. We think there is too much overlap with scripts in package.json to use it as npm scripts.

[ljharb]

That name also properly conveys that it's only install scripts, and not other lifecycle scripts, that are affected.

[manzoorwanijk]

Created #9629

[manzoorwanijk]

@JamieMagee @owlstronaut should we change that npm warn allow-scripts to npm warn install-scripts as well?