v1: npm 11.19 warns about unreviewed install scripts (esbuild, fsevents) on every install

[cliffhall]

Summary

npm 11.19 gates dependency lifecycle install scripts behind an allowScripts allowlist. Any package with an install script that has not been explicitly reviewed produces a warning on every npm install:

npm warn install-scripts 3 packages have install scripts not yet covered by allowScripts:
npm warn install-scripts   esbuild@0.28.1 (postinstall: node install.js)
npm warn install-scripts   fsevents@2.3.3 (install: (install scripts present))
npm warn install-scripts   fsevents@2.3.2 (install: (install scripts present))
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.

Three packages are pending: esbuild's postinstall, and two copies of fsevents (2.3.3 at the root, 2.3.2 under playwright/).

This is noise rather than breakage — the skipped scripts are not needed, as detailed below. But it appears on every install for anyone building v1, and a standing warning trains people to ignore install-script warnings generally, which is the opposite of what the npm feature is for.

Neither package needs its install script

esbuild — modern esbuild resolves its platform binary through optionalDependencies (@esbuild/darwin-arm64 and friends). install.js is only a validation / fallback-download step. With the script skipped, node_modules/.bin/esbuild --version reports 0.28.1 correctly and vite bundles normally.

fsevents — both copies ship a prebuilt fsevents.node in the tarball; the install script is a node-gyp rebuild fallback. Both binaries are present after an install with scripts skipped. It is also an optional, macOS-only dependency used for file watching.

Deny rather than approve

Both approve and deny silence the warning. Deny is the better choice here:

• Approving grants a standing "run this package's arbitrary install script" permission that persists across future versions of that package. That is a supply-chain surface worth not opening when nothing needs it.
• Denying records the same review decision, keeps the warning quiet, and costs nothing, because neither script does anything this repo depends on.

Note that npm 11.19 writes allowScripts into package.json, not ~/.npmrc — so this is a tracked repo change and needs to be a deliberate one, not something each contributor applies locally.

Proposed change

"allowScripts": {
  "esbuild": false,
  "fsevents": false
}

After which npm install-scripts ls reports No packages with unreviewed install scripts.

Verification

Everything in the repo has been built and tested with these scripts skipped (npm ci --ignore-scripts): npm run build and npm run lint pass, and all suites pass (539 client + 37 server + 85 CLI). The app starts, serves the client, gates proxy auth correctly, and completes a full MCP tools/list + tools/call round-trip through the CLI.

Scope caveat

AGENTS.md scopes v1/main to security fixes only, and this is build-config hygiene rather than a security fix — so unlike #2072 and #2074 it does not have that justification. It is raised here because the warning only affects people building v1, and v1 is where it appears. Entirely reasonable to decline on scope grounds; the PR is small and self-contained either way.