npm/cli
Pull Request Overview
- Opened on September 3, 2026
- Status Open
- Commit count 2 with first commit September 3, 2026
Total Delta
37 Total Diff Delta
Open Days
Open 12 weekdays
Test Delta
28 Diff Delta in Test Files
Breakdown by Phase
How long has this pull request spent in each phase of its lifecycle?
| Fraction of total time | Business days | Phase |
|---|---|---|
|
|
0.3 days | Authoring 2 commits before pull request opened for review |
|
|
0.0 days | Awaiting first review |
|
|
11.0 days | Revising work with 0 commits in response to 1 review that left 1 comment |
Total time for pull request still awaiting merge (longer than repo's target): 11.3 business days
feat(token): support read-write-stage-only granular access tokens
Summary
Adds a read-write-stage-only value to the packages-and-scopes-permission option for npm token create, letting the CLI create granular access tokens with a stage-only publish policy (parity with the web UI). Also adds a deprecation warning when creating a direct-publish-capable token, steering users toward the stage-only value.
Changes
- Add
read-write-stage-onlyto thepackages-and-scopes-permissionconfig enum and update its description.orgs-permissionis intentionally left unchanged (the registry only acceptsread-write-stage-onlyfor packages/scopes). -
token createalready forwardspackages_and_scopes_permissionverbatim in the POST body, so the value flows straight to the registry create-token route, which normalizes it topublish_policy: stage_only— identical to the web UI. - Add a
log.warnwhen creating a token withread-writepackage/scope permission (direct-publish-capable), pointing users to--packages-and-scopes-permission=read-write-stage-only. Stage-only, read-only, and no-access tokens do not warn;--bypass-2fais orthogonal and does not by itself trigger the warning. - Tests: creating a stage-only token asserts the POST body carries the value and emits no warning; read-write (with and without
--bypass-2fa) emits the warning;--bypass-2faalone does not. - Regenerate affected tap snapshots (
docs.js,workspaces/configtype-description.js).
Comments Threads Pending Resolution
Resolved Comment Threads
No resolved comments have been left on this PR.
## Copilot review overview
### 🟢 Approval recommended
The implementation matches the stated behavior and includes focused coverage for each permission scenario.
**Review tier:** Balanced
**Findings:** None
What changed in this PR
Adds stage-only granular token support and warns users creating direct-publish-capable tokens.
**Changes:**
- Adds and documents the `read-write-stage-only` permission.
- Warns when creating `read-write` tokens.
- Adds coverage and updates generated snapshots.
| File | Description |
| ---- | ----------- |
| `workspaces/config/lib/definitions/definitions.js` | Defines and documents the new permission. |
| `lib/commands/token.js` | Adds the direct-publish warning. |
| `test/lib/commands/token.js` | Tests forwarding and warning behavior. |
| `workspaces/config/tap-snapshots/test/type-description.js.test.cjs` | Updates configuration snapshots. |
| `tap-snapshots/test/lib/docs.js.test.cjs` | Updates generated documentation snapshots. |
---
💡 Add a `code-review` agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.