bb plugin new --app omits required dev dependencies under NODE_ENV=production

[galligan]

Workflow

Create a frontend plugin with the packaged BB CLI, then build it:

bb plugin new scaffold-repro --app
cd bb-plugin-scaffold-repro
bb plugin build .

Actual behavior

bb plugin new --app reports:

Installed component dependencies (npm install).

but a clean scaffold can then fail to build because packages such as zod were not installed.

The scaffold puts required build and type dependencies—including TypeScript, Zod, Hono, better-sqlite3, and React types—in devDependencies. The CLI currently launches:

npm install --no-fund --no-audit

The packaged CLI runs with NODE_ENV=production. npm honors that inherited environment by omitting devDependencies, exits successfully, and the CLI marks the installation as successful even though the generated plugin is not buildable.

This was reproduced with a clean bb plugin new --app scaffold outside the BB and plugin repositories. Running npm install --include=dev in the generated directory made the build succeed.

Expected behavior

When the scaffold command says it installed the generated plugin's dependencies, the plugin should be ready for bb plugin build regardless of the parent CLI's NODE_ENV.

Suggested fix

Make the CLI-owned install explicit:

npm install --include=dev --no-fund --no-audit

The existing warning and manual npm install fallback can remain for a genuine npm failure.

Acceptance criteria

• A regression test runs the app-scaffold installation path with NODE_ENV=production.
• The successful path installs the scaffold's required development dependencies.
• A freshly generated app plugin typechecks or builds without a second manual install.
• The CLI does not report a successful dependency installation when the generated plugin is missing the dependencies it needs to build.

Current code

• Scaffold command: apps/cli/src/commands/plugin.ts
• Generated dependency split: packages/templates/src/plugin-scaffold.ts