When installing packages with build scripts not in Dyad's curated allow-list (e.g., core-js), pnpm defaults to skipping these builds. Under pnpm 11's strictDepBuilds: true setting, a standard pnpm install will fail with ERR_PNPM_IGNORED_BUILDS (exit 1) if these builds are not explicitly handled.
To prevent broken builds in exported repositories (Vercel, Netlify, CI) or during Dyad Rebuild operations, Dyad implements an Auto-Deny mechanism:
- Detection: Dyad reads
.modules.yaml to identify packages that were implicitly ignored during the initial install. - Recording: Dyad automatically records an explicit
pkg: false decision in the pnpm-workspace.yaml file under the allowBuilds map. This entry is placed outside the Dyad-managed block and includes a Dyad marker. - Result: This explicit denial silences both the
ERR_PNPM_IGNORED_BUILDS error and the pnpm warning, ensuring that subsequent pnpm install commands (without special Dyad flags) succeed while maintaining the security posture of skipping unapproved build scripts.
Note on Rebuilds: A standard pnpm install on an "already up to date" environment exits 0 and does not re-evaluate build scripts. To force a previously skipped build to run, you must use pnpm rebuild <pkg>.
# Example of what Dyad records in pnpm-workspace.yaml
allowBuilds:
# dyad-managed-block-start
# ... existing allowed builds ...
# dyad-managed-block-end
# dyad-auto-deny-marker
core-js: false