Bug: npm install -g code-server fails on npm 12 with "Unknown cli flag: --unsafe-perm"
code-server's installer passes --unsafe-perm to npm, but npm 12 removed that flag and now errors on any unknown flag instead of ignoring it. Result: the install dies before it even starts.
How to reproduce (2 commands, ~45 seconds)
npm --version # must be 12.x (Node 22+ ships npm 11+; install npm@12 first if needed)
npm install -g code-server@4.117.0 --unsafe-perm
Expected: code-server installs.
Actual:
npm error code EUNKNOWNCONFIG
npm error Unknown cli flag:
npm error - --unsafe-perm
npm error Run `npm help config` for supported options.
That's it. No code-server source needed — the failure is npm rejecting the flag that install.sh passes.
Where the flag lives
Three active places pass or require --unsafe-perm:
install.sh line 439 — npm install ... --unsafe-permci/build/npm-postinstall.sh lines 79–92 — root-only npm_config_unsafe_perm guardci/build/npm-postinstall.sh lines 111–116 — nested npm install --unsafe-perm
Why it's safe to remove
npm stopped needing --unsafe-perm in npm 7 — when npm runs as root, lifecycle scripts already run with the effective UID/GID of the package directory owner. The flag has been a no-op for years; npm 12 just finally made passing it an error. See npm's changelog: https://docs.npmjs.com/cli/v7/using-npm/changelog/#root-user-does-not-drop-privileges
Environment
- Node.js 22.22.2, npm 12.0.2
- code-server 4.117.0 (install fails before running)
- Debian 13
Bonus caveat (read before saying "just remove it")
With --unsafe-perm gone, npm 12's new lifecycle-script policy also blocks code-server's postinstall by default:
npm warn install-scripts 2 packages had install scripts blocked...
npm warn install-scripts code-server@4.117.0 (postinstall: sh ./postinstall.sh)
npm warn install-scripts argon2@0.44.0 (install: ...)
So removing the flag fixes the crash, but full npm 12 support also needs the --allow-scripts=code-server,argon2 (or equivalent) handling. I have a test-backed patch for the --unsafe-perm part (36/36 script tests pass) — happy to open a PR if this is accepted.
Bug:
npm install -g code-serverfails on npm 12 with "Unknown cli flag: --unsafe-perm"code-server's installer passes
--unsafe-permto npm, but npm 12 removed that flag and now errors on any unknown flag instead of ignoring it. Result: the install dies before it even starts.How to reproduce (2 commands, ~45 seconds)
npm --version # must be 12.x (Node 22+ ships npm 11+; install npm@12 first if needed) npm install -g code-server@4.117.0 --unsafe-permExpected: code-server installs.
Actual:
That's it. No code-server source needed — the failure is npm rejecting the flag that
install.shpasses.Where the flag lives
Three active places pass or require
--unsafe-perm:install.shline 439 —npm install ... --unsafe-permci/build/npm-postinstall.shlines 79–92 — root-onlynpm_config_unsafe_permguardci/build/npm-postinstall.shlines 111–116 — nestednpm install --unsafe-permWhy it's safe to remove
npm stopped needing
--unsafe-permin npm 7 — when npm runs as root, lifecycle scripts already run with the effective UID/GID of the package directory owner. The flag has been a no-op for years; npm 12 just finally made passing it an error. See npm's changelog: https://docs.npmjs.com/cli/v7/using-npm/changelog/#root-user-does-not-drop-privilegesEnvironment
Bonus caveat (read before saying "just remove it")
With
--unsafe-permgone, npm 12's new lifecycle-script policy also blocks code-server's postinstall by default:So removing the flag fixes the crash, but full npm 12 support also needs the
--allow-scripts=code-server,argon2(or equivalent) handling. I have a test-backed patch for the--unsafe-permpart (36/36 script tests pass) — happy to open a PR if this is accepted.