feat(token): support read-write-stage-only granular access tokens - #9948
Open
Tayvon wants to merge 2 commits into
Open
feat(token): support read-write-stage-only granular access tokens#9948Tayvon wants to merge 2 commits into
Tayvon wants to merge 2 commits into
Conversation
Adds the granular-token stage-only publish policy value to the packages-and-scopes-permission option. The value is forwarded as-is to the registry create-token route, where it normalizes to a stage_only publish policy (identical to the web UI). Ref: github/npm#15609 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f2e357f-6da8-4978-a637-f14539820093
Emits a log.warn when creating a granular access token that can publish directly to the registry (a read-write packages-and-scopes permission), steering users toward read-write-stage-only tokens. bypass-2fa is orthogonal and does not trigger the warning on its own. Ref: github/npm#15609 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0f2e357f-6da8-4978-a637-f14539820093
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The implementation matches the stated behavior and includes focused coverage for each permission scenario.
Review tier: Balanced
Findings: None
What changed in this PR
Adds stage-only granular token support and warns users creating direct-publish-capable tokens.
Changes:
- Adds and documents the
read-write-stage-onlypermission. - Warns when creating
read-writetokens. - Adds coverage and updates generated snapshots.
| File | Description |
|---|---|
workspaces/config/lib/definitions/definitions.js |
Defines and documents the new permission. |
lib/commands/token.js |
Adds the direct-publish warning. |
test/lib/commands/token.js |
Tests forwarding and warning behavior. |
workspaces/config/tap-snapshots/test/type-description.js.test.cjs |
Updates configuration snapshots. |
tap-snapshots/test/lib/docs.js.test.cjs |
Updates generated documentation snapshots. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dhei
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
read-write-stage-onlyvalue to thepackages-and-scopes-permissionoption fornpm token create, letting the CLI create granular access tokens with a stage-only publish policy (parity with the web UI). Also adds a deprecation warning when creating a direct-publish-capable token, steering users toward the stage-only value.Changes
read-write-stage-onlyto thepackages-and-scopes-permissionconfig enum and update its description.orgs-permissionis intentionally left unchanged (the registry only acceptsread-write-stage-onlyfor packages/scopes).token createalready forwardspackages_and_scopes_permissionverbatim in the POST body, so the value flows straight to the registry create-token route, which normalizes it topublish_policy: stage_only— identical to the web UI.log.warnwhen creating a token withread-writepackage/scope permission (direct-publish-capable), pointing users to--packages-and-scopes-permission=read-write-stage-only. Stage-only, read-only, and no-access tokens do not warn;--bypass-2fais orthogonal and does not by itself trigger the warning.--bypass-2fa) emits the warning;--bypass-2faalone does not.docs.js,workspaces/configtype-description.js).