fix(add): accept dangerously-allow-all-builds

[risu729]

Summary

• accept --dangerously-allow-all-builds on aube add
• forward the transient build-policy override through local, filtered, and global add paths
• reject the contradictory combination with --deny-build=<pkg>
• document the flag and cover the mise command shape with parser and global-install regressions

Root cause

The failure was reported in this mise discussion comment: mise invokes aube add --global <package> --dangerously-allow-all-builds, but aube declared the broad flag only on InstallArgs. Clap therefore rejected it before add could enter the install pipeline.

aube add already chains into that pipeline, and its selective --allow-build=<pkg> option is forwarded through the synthetic global install. The broad option was simply absent from AddArgs and from that forwarding path. This seems unintentional given aube's pnpm CLI parity goal and pnpm's support for the same command-line setting on add. If keeping this escape hatch install-only is intentional, please feel free to close this PR.

The new option is invocation-scoped; it does not persist dangerouslyAllowAllBuilds=true in project configuration.

Validation

• cargo test -p aube — 644 unit tests, 7 Rust e2e tests
• mise run test:bats test/global_install.bats — 24 tests
• cargo clippy --all-targets -- -D warnings
• cargo fmt --check
• mise run render
• git diff --check

Summary by CodeRabbit

• New Features

  • Added aube add --dangerously-allow-all-builds to permit all dependency lifecycle scripts for a single invocation, bypassing the build allowlist (including for -g/--global installs).

• Bug Fixes

  • Ensures the flag is correctly applied to the underlying install flow for both local and global additions.

• Documentation

  • Documented the new flag and warned against using it in CI.
  • Updated --deny-build help to note it conflicts with --dangerously-allow-all-builds.

• Tests

  • Added regression tests for CLI parsing and the global-build behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

The aube add command now supports --dangerously-allow-all-builds, forwarding it through filtered and global installs to enable all dependency lifecycle scripts. CLI documentation, parser coverage, and a global-install integration test were added.

Changes

Dangerously allow all builds

Layer / File(s)	Summary
CLI flag contract and parsing aube.usage.kdl, crates/aube/src/commands/add/mod.rs, crates/aube/src/lib.rs, docs/cli/add.md, docs/cli/commands.json	Defines, documents, parses, and tests the new flag and its conflict with --deny-build.
Global add forwarding crates/aube/src/commands/add/mod.rs, crates/aube/src/commands/add/global.rs	Forwards the flag through global add handling into the inner AddArgs install flow.
Install option application and validation crates/aube/src/commands/add/mod.rs, crates/aube/src/commands/add/filtered.rs, test/global_install.bats	Applies the flag to install options and verifies that global dependency build scripts execute under strict build settings.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AddCLI
  participant AddRun
  participant GlobalAdd
  participant InstallRun
  AddCLI->>AddRun: parse dangerously_allow_all_builds
  AddRun->>GlobalAdd: forward flag for global installs
  AddRun->>InstallRun: apply install option and CLI flag
  GlobalAdd->>InstallRun: invoke inner add with forwarded flag

Loading

Poem

A rabbit found a build flag bright,
And skipped the allowlist overnight.
Scripts now hop and run with flair,
While CI gets a warning: beware!
“Dangerous,” it whispers—then bounds from sight.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately describes the main change: adding support for the new add flag.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR adds --dangerously-allow-all-builds to aube add, fixing a regression where mise's aube add --global <pkg> --dangerously-allow-all-builds invocation was rejected by clap because the flag only existed on InstallArgs, not AddArgs.

• Core fix: The flag is added to AddArgs and forwarded through all three add code paths — direct local, filtered workspace, and global — via a shared apply_dangerously_allow_all_builds helper that sets install_opts.dangerously_allow_all_builds and pushes the CLI flag tuple.
• Conflict enforcement: --deny-build now uses conflicts_with_all = [\"no_save\", \"dangerously_allow_all_builds\"] so clap rejects contradictory invocations at the argument-parsing layer.
• Refactor: Individual args to run_global / run_global_inner are consolidated into a GlobalAddOptions struct, eliminating the #[allow(clippy::too_many_arguments)] suppression and making future additions cleaner.

Confidence Score: 5/5

Safe to merge — the change is a targeted flag addition that threads through existing infrastructure with no new install logic.

The three code paths (local, filtered, global) each correctly call the shared helper before the install pipeline. The deny_build clap conflict is enforced at parse time. Documentation is updated consistently across KDL, Markdown, and the generated JSON. Tests cover the parse regression and the global E2E path that triggered the original bug report.

No files require special attention.

Important Files Changed

Filename	Overview
crates/aube/src/commands/add/mod.rs	Adds dangerously_allow_all_builds to AddArgs, enforces clap conflict with deny_build, and applies the flag via the shared apply_dangerously_allow_all_builds helper before the install pipeline. Logic is correct on all three code paths.
crates/aube/src/commands/add/global.rs	Refactors individual args into a GlobalAddOptions struct and threads dangerously_allow_all_builds through run_global → run_global_inner → inner synthetic AddArgs. The field is correctly forwarded to the re-entered local run() call.
crates/aube/src/commands/add/filtered.rs	Correctly calls apply_dangerously_allow_all_builds before install::run, consistent with the local and global paths.
crates/aube/src/lib.rs	Adds two unit tests: one verifying the flag parses after a positional package arg, and one asserting the clap conflict with --deny-build. Both cover the reported regression from the mise discussion.
test/global_install.bats	Adds an E2E bats test with AUBE_STRICT_DEP_BUILDS=true that asserts unreviewed builds succeed when --dangerously-allow-all-builds is passed and no allowlist entry is written to package.json.
aube.usage.kdl	Documents the new flag in the KDL usage spec and updates --deny-build's long_help to note the conflict with --dangerously-allow-all-builds.
docs/cli/add.md	Adds CLI documentation for --dangerously-allow-all-builds and updates --deny-build docs to mention the conflict.
docs/cli/commands.json	Generated JSON schema updated with the new flag entry and updated help_long for deny-build. Consistent with the other doc files.

_{Reviews (2): Last reviewed commit: "fix(add): reject conflicting build polic..." | Re-trigger Greptile}

[coderabbitai]

🧹 Nitpick comments (1)

crates/aube/src/commands/add/global.rs (1)

21-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoff

Consider bundling the growing bool/Vec parameter list into a struct.

run_global/run_global_inner now carry several adjacent same-typed parameters (allow_low_downloads: bool, dangerously_allow_all_builds: bool, plus allow_build/deny_build: Vec<String>). The compiler can't catch an accidental positional swap between the two bool params since they're structurally identical — this PR itself had to touch three call sites in lockstep to add the new flag correctly. A small BuildPolicy/AddFlags struct passed by value would make future additions safer against silent argument-order bugs.

This is optional since the team already suppresses clippy::too_many_arguments here, indicating an accepted tradeoff — not blocking.

Also applies to: 118-129

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/aube/src/commands/add/global.rs` around lines 21 - 31, Consider
replacing the adjacent build-related parameters in run_global and
run_global_inner with a dedicated value object such as BuildPolicy or AddFlags
containing allow_build, deny_build, allow_low_downloads, and
dangerously_allow_all_builds. Update both function signatures and all call sites
to pass the struct, preserving existing behavior while preventing positional
swaps and simplifying future flag additions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/aube/src/commands/add/global.rs`:
- Around line 21-31: Consider replacing the adjacent build-related parameters in
run_global and run_global_inner with a dedicated value object such as
BuildPolicy or AddFlags containing allow_build, deny_build, allow_low_downloads,
and dangerously_allow_all_builds. Update both function signatures and all call
sites to pass the struct, preserving existing behavior while preventing
positional swaps and simplifying future flag additions.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3565678a-f069-4592-b867-59c2e24b3d29

📥 Commits

Reviewing files that changed from the base of the PR and between b796be9 and 3cc0ffd.

📒 Files selected for processing (8)

• aube.usage.kdl
• crates/aube/src/commands/add/filtered.rs
• crates/aube/src/commands/add/global.rs
• crates/aube/src/commands/add/mod.rs
• crates/aube/src/lib.rs
• docs/cli/add.md
• docs/cli/commands.json
• test/global_install.bats