From 473d2164e7db846b6b2fd61a152bfa9de27f99a5 Mon Sep 17 00:00:00 2001
From: Fnine59 <36078040+Fnine59@users.noreply.github.com>
Date: Mon, 24 Aug 2026 01:31:14 +0000
Subject: [PATCH 1/3] fix(config): avoid exporting persistent allow-scripts

---
 .../config/lib/definitions/definitions.js     |  1 +
 workspaces/config/test/set-envs.js            | 28 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/workspaces/config/lib/definitions/definitions.js b/workspaces/config/lib/definitions/definitions.js
index f932d8f48103c..047a2da4bfa1f 100644
--- a/workspaces/config/lib/definitions/definitions.js
+++ b/workspaces/config/lib/definitions/definitions.js
@@ -271,6 +271,7 @@ const definitions = {
     default: '',
     type: [String, Array],
     hint: '<package-list>',
+    envExport: false,
     description: `
       Comma-separated list of packages whose install-time lifecycle scripts
       (\`preinstall\`, \`install\`, \`postinstall\`, and \`prepare\` for
diff --git a/workspaces/config/test/set-envs.js b/workspaces/config/test/set-envs.js
index c7af0faca33c0..e20428d033611 100644
--- a/workspaces/config/test/set-envs.js
+++ b/workspaces/config/test/set-envs.js
@@ -241,3 +241,31 @@ t.test('dont set configs marked as envExport:false', t => {
   t.strictSame(env, { ...extras }, 'not exported, because envExport=false')
   t.end()
 })
+
+t.test('does not export persistent allow-scripts config', t => {
+  const { definitions, defaults } = mockDefinitions(t)
+  const userConf = Object.create(defaults)
+  userConf['allow-scripts'] = 'canvas'
+  const envConf = Object.create(userConf)
+  const cliConf = Object.create(envConf)
+  const env = {}
+  const config = {
+    list: [cliConf, envConf],
+    env,
+    defaults,
+    definitions,
+    execPath,
+    globalPrefix,
+    localPrefix,
+    npmPath,
+    npmBin,
+  }
+
+  setEnvs(config)
+  t.equal(
+    env.npm_config_allow_scripts,
+    undefined,
+    'persistent policy is reloaded instead of exported to lifecycle scripts'
+  )
+  t.end()
+})

From 3a3a553f0811dd50d2d35ba667efc4ce3c4f3c19 Mon Sep 17 00:00:00 2001
From: Fnine59 <fnine59@163.com>
Date: Fri, 28 Aug 2026 02:12:23 +0800
Subject: [PATCH 2/3] chore(config): add allow-scripts policy coverage

---
 test/lib/utils/resolve-allow-scripts.js | 16 ++++++++++++++++
 workspaces/config/test/set-envs.js      |  8 ++++++++
 2 files changed, 24 insertions(+)

diff --git a/test/lib/utils/resolve-allow-scripts.js b/test/lib/utils/resolve-allow-scripts.js
index a27d600d98f04..650094ba170bd 100644
--- a/test/lib/utils/resolve-allow-scripts.js
+++ b/test/lib/utils/resolve-allow-scripts.js
@@ -86,6 +86,22 @@ t.test('--allow-scripts CLI flag is rejected in project-scoped installs', async
   )
 })
 
+t.test('allow-scripts environment policy is rejected in project-scoped installs', async t => {
+  const mock = await mockNpm(t, {
+    prefixDir: {
+      'package.json': JSON.stringify({ name: 'p' }),
+    },
+    globals: {
+      'process.env.npm_config_allow_scripts': 'canvas',
+    },
+  })
+  const resolveAllowScripts = loadResolver(t)
+  await t.rejects(
+    resolveAllowScripts(mock.npm),
+    { code: 'EALLOWSCRIPTS', message: /--allow-scripts is not allowed/ }
+  )
+})
+
 t.test('--allow-scripts CLI flag is accepted in global installs (RFC layer 1 wins)', async t => {
   const mock = await mockNpm(t, {
     prefixDir: {
diff --git a/workspaces/config/test/set-envs.js b/workspaces/config/test/set-envs.js
index e20428d033611..942626531eccc 100644
--- a/workspaces/config/test/set-envs.js
+++ b/workspaces/config/test/set-envs.js
@@ -267,5 +267,13 @@ t.test('does not export persistent allow-scripts config', t => {
     undefined,
     'persistent policy is reloaded instead of exported to lifecycle scripts'
   )
+  envConf['allow-scripts'] = 'sharp'
+  env.npm_config_allow_scripts = 'sharp'
+  setEnvs(config)
+  t.equal(
+    env.npm_config_allow_scripts,
+    'sharp',
+    'an explicit environment policy remains inherited'
+  )
   t.end()
 })

From c06d865f9ce26245499cd2cfe02ed38807f7d9df Mon Sep 17 00:00:00 2001
From: Fnine59 <fnine59@163.com>
Date: Sat, 29 Aug 2026 02:12:42 +0800
Subject: [PATCH 3/3] chore(config): update docs snapshot

---
 tap-snapshots/test/lib/docs.js.test.cjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tap-snapshots/test/lib/docs.js.test.cjs b/tap-snapshots/test/lib/docs.js.test.cjs
index dbfc88ab63abc..c8c296208796e 100644
--- a/tap-snapshots/test/lib/docs.js.test.cjs
+++ b/tap-snapshots/test/lib/docs.js.test.cjs
@@ -334,7 +334,7 @@ Each name is matched against a dependency's resolved identity, not against
 the package's self-reported name. \`--ignore-scripts\` and
 \`--dangerously-allow-all-scripts\` both override this setting.
 
-
+This value is not exported to the environment for child processes.
 
 #### \`allow-scripts-pending\`