From 473d2164e7db846b6b2fd61a152bfa9de27f99a5 Mon Sep 17 00:00:00 2001
From: Fnine59 <36078040+Fnine59@users.noreply.github.com>
Date: Mon, 24 Aug 2026 01:31:14 +0000
Subject: [PATCH] fix(config): avoid exporting persistent allow-scripts

---
 .../config/lib/definitions/definitions.js     |  1 +
 workspaces/config/test/set-envs.js            | 28 +++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/workspaces/config/lib/definitions/definitions.js b/workspaces/config/lib/definitions/definitions.js
index f932d8f48103c..047a2da4bfa1f 100644
--- a/workspaces/config/lib/definitions/definitions.js
+++ b/workspaces/config/lib/definitions/definitions.js
@@ -271,6 +271,7 @@ const definitions = {
     default: '',
     type: [String, Array],
     hint: '<package-list>',
+    envExport: false,
     description: `
       Comma-separated list of packages whose install-time lifecycle scripts
       (\`preinstall\`, \`install\`, \`postinstall\`, and \`prepare\` for
diff --git a/workspaces/config/test/set-envs.js b/workspaces/config/test/set-envs.js
index c7af0faca33c0..e20428d033611 100644
--- a/workspaces/config/test/set-envs.js
+++ b/workspaces/config/test/set-envs.js
@@ -241,3 +241,31 @@ t.test('dont set configs marked as envExport:false', t => {
   t.strictSame(env, { ...extras }, 'not exported, because envExport=false')
   t.end()
 })
+
+t.test('does not export persistent allow-scripts config', t => {
+  const { definitions, defaults } = mockDefinitions(t)
+  const userConf = Object.create(defaults)
+  userConf['allow-scripts'] = 'canvas'
+  const envConf = Object.create(userConf)
+  const cliConf = Object.create(envConf)
+  const env = {}
+  const config = {
+    list: [cliConf, envConf],
+    env,
+    defaults,
+    definitions,
+    execPath,
+    globalPrefix,
+    localPrefix,
+    npmPath,
+    npmBin,
+  }
+
+  setEnvs(config)
+  t.equal(
+    env.npm_config_allow_scripts,
+    undefined,
+    'persistent policy is reloaded instead of exported to lifecycle scripts'
+  )
+  t.end()
+})