[autoconfig] Approve required pnpm builds before installing Cloudflare packages

[penalosa]

Problem

When cf init is run in an existing project, it delegates setup to @cloudflare/autoconfig. In packages/autoconfig/src/run.ts, runAutoConfig() can install cf@latest, Wrangler, and framework integration packages using the project's package manager. For pnpm 11+, an install can fail with ERR_PNPM_IGNORED_BUILDS if the active pnpm-workspace.yaml has not approved the workerd and esbuild build scripts.

The new Worker scaffold in cloudflare/cf#136 writes these approvals before pnpm install, following the create-cloudflare fix in #14193. The existing-project path still relies on autoconfig and has no equivalent approval step. This is adjacent to cloudflare/cf#92.

Proposed behavior

• When autoconfig selects pnpm, add allowBuilds approvals for the Cloudflare dependencies it installs that require scripts (workerd and esbuild) before its first package installation.
• Update the active workspace's pnpm-workspace.yaml, including when the project is inside a pnpm workspace. Preserve existing workspace settings, other approval entries, and explicit false decisions. Respect dangerouslyAllowAllBuilds: true rather than adding a conflicting policy.
• Avoid writing during dry runs or when setup is cancelled. Leave non-pnpm projects unchanged. Do not pre-approve unrelated framework dependencies.
• Cover the existing-project autoconfig flow with pnpm 11+ and an existing workspace file in tests.

This should cover both autoconfig's cf and Wrangler targets, which can install Cloudflare packages.

[workers-devprod]

Automated triage

Issue assessment

• Actionability: ✅ Actionable.
• Type: Bug (medium confidence).
• Reproduction: Automatic attempt requested.
• Labels:
  • feature:auto-config (high)

Actionability and missing information

Autoconfig's existing-project flow installs Cloudflare packages without pnpm build approvals, so pnpm 11+ installs can fail with ERR_PNPM_IGNORED_BUILDS; report names the code path, trigger conditions, expected behavior, and test coverage.

Reproduction reason: Concrete current-behavior defect in the existing-project autoconfig flow with specific trigger conditions (pnpm 11+, unapproved workerd/esbuild builds) and a named failure mode; no suspicious content.

Reproduction

• Result: ✅ Reproduced.
• Summary: Reproduced: cloudflare/autoconfig 0.7.5 installs cf/wrangler via pnpm 11.28.3 without writing build-script approvals, so the install exits 1 with ERR_PNPM_IGNORED_BUILDS and runAutoConfig() aborts mid-setup, leaving the active pnpm-workspace.yaml unmodified.

Evidence and attempted steps

Steps attempted:

1. Created the existing-project fixture (package.json, index.html, pnpm-workspace.yaml with only packages: ['.'], pnpm 11 lockfile) and installed its node_modules with pnpm 11.28.3, so package-manager detection resolves to pnpm.
   • Command: printf 'packages:\n - "."\n' > pnpm-workspace.yaml && pnpm install
2. Baseline check (no autoconfig involved) that pnpm 11 hard-fails an install whose dependencies need unapproved build scripts in a workspace yaml without approvals.
   • Command: pnpm install --save-dev wrangler@latest
3. Ran the real autoconfig flow from the workers-sdk checkout build of packages/autoconfig 0.7.5 (getDetailsForAutoConfig + runAutoConfig) with target cf against a fresh fixture copy; run exited 1 with ERR_PNPM_IGNORED_BUILDS and no approvals written.
   • Command: AUTOCONFIG_SOURCE=repo node run-autoconfig.mjs <run-dir> cf
4. Same flow with autoconfig's Wrangler target, which installs the latest wrangler; run exited 1 with ERR_PNPM_IGNORED_BUILDS listing esbuild and workerd, workspace file unchanged.
   • Command: AUTOCONFIG_SOURCE=repo node run-autoconfig.mjs <run-dir> wrangler
5. Repeated the cf-target run using the published cloudflare/autoconfig 0.7.5 package instead of the checkout build; identical failure and unchanged workspace file.
   • Command: node run-autoconfig.mjs <run-dir> cf
6. Control run: pre-wrote the allowBuilds approvals the issue proposes autoconfig should write, then ran the identical cf-target flow; it completed with exit code 0, installing cf and wrangler and writing cloudflare.config.ts/wrangler.config.ts.
   • Command: printf 'allowBuilds:\n esbuild: true\n workerd: true\n' >> <run-dir>/pnpm-workspace.yaml && AUTOCONFIG_SOURCE=repo node run-autoconfig.mjs <run-dir> cf
7. Nested-workspace variant: project inside a pnpm workspace with the active (root) pnpm-workspace.yaml lacking approvals; install failed with ERR_PNPM_IGNORED_BUILDS (workerd) and neither the root nor project workspace file gained approvals.
   • Command: AUTOCONFIG_SOURCE=repo node run-autoconfig.mjs <workspace-root>/apps/existing-project cf
8. Validated the reproduction-output project standalone (no checkout needed): pnpm reproduce reproduced the failure (exit 1, ERR_PNPM_IGNORED_BUILDS, no allowBuilds written) and its --pre-approve control completed with exit code 0.
   • Command: pnpm install && pnpm reproduce --run-dir <dir>

Expected behavior: When autoconfig selects pnpm, it should add allowBuilds approvals for the Cloudflare dependencies it installs that require build scripts (workerd and esbuild) to the active workspace's pnpm-workspace.yaml before its first package installation (skipping dry runs and cancellations, respecting dangerouslyAllowAllBuilds: true, and leaving non-pnpm projects unchanged), including when the project sits inside a pnpm workspace. With approvals present the pnpm 11+ installs succeed and the flow completes; the control run with pre-written allowBuilds {esbuild: true, workerd: true} did complete successfully.

Observed behavior: In an existing static project using pnpm 11.28.3 whose pnpm-workspace.yaml lacks build approvals, autoconfig detected packageManager=pnpm and ran "pnpm install --save-dev cf (latest tag) --workspace-root" (target cf) or "pnpm install --save-dev wrangler (latest tag) --workspace-root" (target wrangler); cf resolved to 1.0.0-beta.10, wrangler to 4.145.0. pnpm exited 1 with "[ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: workerd 1.20260930.2" (cf) and "esbuild 0.28.1, workerd 1.20260930.2" (wrangler); runAutoConfig() threw, aborting setup before any configuration or script updates. pnpm-workspace.yaml was unchanged (no allowBuilds) after every run, including the active root workspace file for a project nested inside a pnpm workspace. The published cloudflare/autoconfig 0.7.5 package and the workers-sdk checkout build (also 0.7.5) behaved identically.

Artifact: Download reproduction archive (Cloudflare Access required).

Treat archive contents as untrusted. Inspect them before running anything.

---

This summary was generated by an LLM and may contain errors. Please verify its findings.

Triage bot commands and options

Repository collaborators with write or admin access can trigger actions by commenting on this issue:

• @workers-devprod reproduce: Attempt to reproduce the issue using its description and recent comments.

[minwookshin]

I can update autoconfig to add the workerd/esbuild build approvals at the pnpm workspace root before installation. I’ll preserve existing approvals and explicit denials, and cover nested workspaces and dry runs.