From 97d94c85de9f4153b4ad20d4da475d5427cc9f42 Mon Sep 17 00:00:00 2001
From: MickLesk <47820557+MickLesk@users.noreply.github.com>
Date: Sun, 25 Oct 2026 12:04:04 +0100
Subject: [PATCH] Set npm's script and git policy for root too, so --prefix
 keeps it

npm takes the global npmrc from <prefix>/etc, so every `npm --prefix /opt/app`
ran without dangerously-allow-all-scripts and npm 12 blocked the install
scripts again: native addons like better-sqlite3 were left unbuilt. Root's
user npmrc applies whatever the prefix; the global one stays for other users.
---
 lib/runtime.func | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/lib/runtime.func b/lib/runtime.func
index 5f777e0..e932b41 100644
--- a/lib/runtime.func
+++ b/lib/runtime.func
@@ -1550,16 +1550,20 @@ setup_nodejs() {
 
   # npm 11+ skips install hooks not covered by allowScripts and still exits 0,
   # so apps with native addons install with nothing built.
-  local npm_major
+  # npm reads the global npmrc from <prefix>/etc, so `npm --prefix /opt/app`
+  # never sees it; the user npmrc applies whatever the prefix.
+  local npm_major npm_location
   npm_major="$(npm -v 2>/dev/null | cut -d. -f1)" || npm_major=""
-  if [[ "$npm_major" -ge 11 ]]; then
-    $STD npm config set dangerously-allow-all-scripts true --location=global 2>/dev/null || true
-  fi
-  # npm 12 refuses git and tarball-URL dependencies by default (EALLOWGIT/EALLOWREMOTE).
-  if [[ "$npm_major" -ge 12 ]]; then
-    $STD npm config set allow-git all --location=global 2>/dev/null || true
-    $STD npm config set allow-remote all --location=global 2>/dev/null || true
-  fi
+  for npm_location in global user; do
+    if [[ "$npm_major" -ge 11 ]]; then
+      $STD npm config set dangerously-allow-all-scripts true --location="$npm_location" 2>/dev/null || true
+    fi
+    # npm 12 refuses git and tarball-URL dependencies by default (EALLOWGIT/EALLOWREMOTE).
+    if [[ "$npm_major" -ge 12 ]]; then
+      $STD npm config set allow-git all --location="$npm_location" 2>/dev/null || true
+      $STD npm config set allow-remote all --location="$npm_location" 2>/dev/null || true
+    fi
+  done
 
   # Set a safe default heap limit for Node.js builds if not explicitly provided.
   # Priority: