Summary
Improve the onboarding experience and security configuration guidance for the cmf CLI by updating the installation documentation to cover the npm allow-scripts setting.
Recent npm CLI versions may restrict install-time scripts by default as a security measure. When that restriction is active, installing @criticalmanufacturing/cli globally can fail or install incompletely unless the package is explicitly allowed to run its install scripts. This is not currently mentioned anywhere in the installation guide, so new users hit it with no guidance.
Current behavior
The installation page documents only:
npm install -g @criticalmanufacturing/cli
There is no mention of allow-scripts, install-time scripts, or npm security restrictions.
Proposed change
Add the following section to the installation documentation (under 2. Install CLI, before or alongside the install command):
By default, the npm CLI may restrict install-time scripts for security. On those cases you will need to grant it using the command:
npm config set allow-scripts=@criticalmanufacturing/cli --location=user
Verified workaround
The command has been verified to unblock the installation by Marco Silva:
root@ed5ab9fcf5b3:/# npm config set allow-scripts=@criticalmanufacturing/cli --location=user
root@ed5ab9fcf5b3:/# npm i -g @criticalmanufacturing/cli
...
changed 105 packages in 7s
root@ed5ab9fcf5b3:/# cmf
Required command was not provided.
Acceptance criteria
Summary
Improve the onboarding experience and security configuration guidance for the cmf CLI by updating the installation documentation to cover the npm
allow-scriptssetting.Recent npm CLI versions may restrict install-time scripts by default as a security measure. When that restriction is active, installing
@criticalmanufacturing/cliglobally can fail or install incompletely unless the package is explicitly allowed to run its install scripts. This is not currently mentioned anywhere in the installation guide, so new users hit it with no guidance.Current behavior
The installation page documents only:
npm install -g @criticalmanufacturing/cli
There is no mention of
allow-scripts, install-time scripts, or npm security restrictions.Proposed change
Add the following section to the installation documentation (under 2. Install CLI, before or alongside the install command):
Verified workaround
The command has been verified to unblock the installation by Marco Silva:
root@ed5ab9fcf5b3:/# npm config set allow-scripts=@criticalmanufacturing/cli --location=user
root@ed5ab9fcf5b3:/# npm i -g @criticalmanufacturing/cli
...
changed 105 packages in 7s
root@ed5ab9fcf5b3:/# cmf
Required command was not provided.
Acceptance criteria