Blanket --allow-scripts aborts entire run when an optionalDependency install script fails #36239

Version

deno 2.9.3+446ed26 (canary) on Windows x64

Description

When running a package that has optionalDependencies with native install scripts (e.g. @stoprocent/noble / @stoprocent/bleno → @stoprocent/bluetooth-hci-socket), using blanket --allow-scripts causes Deno to run those scripts and abort the whole deno run / install if any of them fail.

npm treats optionalDependency install failures as non-fatal. Deno currently does not: one failed optional native build (MSVC/LTO mismatch, missing headers, unsupported platform, etc.) prevents the main package from starting even when that optional path is unused.

Reproduction

Minimal shape (same pattern as npm:@steve02081504/fount-p2p):

{
  "name": "repro",
  "dependencies": { "ws": "latest" },
  "optionalDependencies": {
    "@stoprocent/noble": "latest",
    "@stoprocent/bleno": "latest"
  }
}

# from a directory with the package.json above and deno.json:
# { "nodeModulesDir": "auto" }
deno run -A --allow-scripts ./main.mjs

Observed on Windows: @stoprocent/bluetooth-hci-socket install fails under node-gyp (MSVC chokes on -flto=thin / /opt:lldltojobs=… inherited from Node 26 thin-LTO headers), then Deno reports:

error: failed to run scripts for packages: @stoprocent/bluetooth-hci-socket@…, @stoprocent/bleno@…, @stoprocent/noble@…

and never runs the entrypoint.

Workaround that works today: whitelist only required natives:

deno run -A --node-modules-dir=auto --allow-scripts=npm:node-datachannel …

Expected

• Failed optionalDependency lifecycle scripts should not fail the overall install/deno run (align with npm), or
• Document clearly that blanket --allow-scripts is unsafe with optional natives and recommend allowScripts / --allow-scripts=npm:pkg whitelisting.

Impact (downstream)

@steve02081504/fount-p2p keeps BLE as optional and WebRTC (node-datachannel) as a real dependency. Users who copy deno run -A --allow-scripts npm:@steve02081504/fount-p2p hit a hard crash on Windows even though LAN/Nostr paths do not need BLE.

When this is fixed: drop the “never use blanket --allow-scripts” warning emphasis in fount-p2p docs if Deno matches npm optional semantics; keep allowScripts: ["npm:node-datachannel"] as the still-correct whitelist.

Related

• Support for install scripts (ex. "postinstall") for "npm:" specifiers with global node modules #16164 (install scripts + global npm cache)
• Harden approved npm lifecycle scripts: scrubbed environment, temporary HOME, confined writes #35714 (scrubbing lifecycle-script environment)