@pnpm/installing.commands 1100.2.2 → 1100.3.0

package/lib/fetch.js

@@ -58,6 +58,7 @@ export async function handler(opts) {
         pruneStore: true,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
         // Hoisting is skipped anyway,
         // so we store these empty patterns in node_modules/.modules.yaml
         // to let the subsequent install know that hoisting should be performed.

package/lib/import/index.js

@@ -104,6 +104,7 @@ export async function handler(opts, params) {
         preferredVersions,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
     };
     await install(manifest, installOpts);
 }

package/lib/install.js

@@ -79,6 +79,11 @@ export const cliOptionsTypes = () => ({
     'fix-lockfile': Boolean,
     'resolution-only': Boolean,
     recursive: Boolean,
+    // `--no-save` lets `pnpm install` skip writing to package.json /
+    // pnpm-workspace.yaml. Without registering it here, nopt drops the
+    // flag, `opts.save` stays undefined, and the auto-add path treats
+    // it as "save enabled".
+    save: Boolean,
 });
 export const shorthands = {
     D: '--dev',

package/lib/installDeps.d.ts

@@ -4,7 +4,7 @@ import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
         original: string[];
     };

package/lib/installDeps.js

@@ -17,6 +17,7 @@ import { updateWorkspaceManifest } from '@pnpm/workspace.workspace-manifest-writ
 import { getPinnedVersion } from './getPinnedVersion.js';
 import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
+import { setupPolicyHandlers } from './policyHandlers.js';
 import { createMatcher, makeIgnorePatterns, matchDependencies, recursive, } from './recursive.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 const OVERWRITE_UPDATE_OPTIONS = {
@@ -115,6 +116,12 @@ export async function installDeps(opts, params) {
     else if (opts.runtimeOnFail) {
         applyRuntimeOnFailOverride(manifest, opts.runtimeOnFail);
     }
+    // `setupPolicyHandlers` composes the per-policy handlers the install
+    // needs for the current opts (today: minimumReleaseAge; future:
+    // trustPolicy UX, license policy, etc.). Returns `undefined` when no
+    // handler is active so the install skips the empty no-op call at
+    // every checkpoint when no policies are configured.
+    const policyHandlers = setupPolicyHandlers(opts);
     const installOpts = {
         ...opts,
         // In case installation is done in a multi-package repository
@@ -127,8 +134,10 @@ export async function installDeps(opts, params) {
         skipRuntimes: opts.runtime === false,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
         workspacePackages,
         preferredVersions: opts.packageVulnerabilityAudit ? preferNonvulnerablePackageVersions(opts.packageVulnerabilityAudit) : undefined,
+        handleResolutionPolicyViolations: policyHandlers?.handleResolutionPolicyViolations,
     };
     let updateMatch;
     let updatePackageManifest = opts.updatePackageManifest;
@@ -187,14 +196,20 @@ export async function installDeps(opts, params) {
             rootDir: opts.dir,
             targetDependenciesField: getSaveType(opts),
         };
-        const { updatedCatalogs, updatedProject, ignoredBuilds } = await mutateModulesInSingleProject(mutatedProject, installOpts);
+        const { updatedCatalogs, updatedProject, ignoredBuilds, resolutionPolicyViolations } = await mutateModulesInSingleProject(mutatedProject, installOpts);
         if (opts.save !== false) {
+            // Only pick entries when we'll actually persist. Otherwise the
+            // info log would claim we added entries the workspace manifest
+            // never saw, and the next install would re-prompt or fail
+            // verification.
+            const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
             await Promise.all([
                 writeProjectManifest(updatedProject.manifest),
                 updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, {
                     updatedCatalogs,
                     cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
                     allProjects: opts.allProjects,
+                    ...policyUpdates,
                 }),
             ]);
         }
@@ -211,20 +226,35 @@ export async function installDeps(opts, params) {
         await handleIgnoredBuilds(opts, ignoredBuilds);
         return;
     }
-    const { updatedCatalogs, updatedManifest, ignoredBuilds } = await install(manifest, {
+    const { updatedCatalogs, updatedManifest, ignoredBuilds, resolutionPolicyViolations } = await install(manifest, {
         ...installOpts,
         updatePackageManifest,
         updateMatching,
     });
-    if (opts.update === true && opts.save !== false) {
-        await Promise.all([
-            writeProjectManifest(updatedManifest),
-            updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, {
-                updatedCatalogs,
-                cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
-                allProjects,
-            }),
-        ]);
+    // `opts.save === false` (e.g. `--no-save`) means "don't persist anything
+    // from this install" — both package.json and the workspace manifest.
+    // Skip the pick so the info log doesn't claim entries were added that
+    // were never written; the next install will resurface them.
+    if (opts.save !== false) {
+        const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
+        if (opts.update === true) {
+            await Promise.all([
+                writeProjectManifest(updatedManifest),
+                updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, {
+                    updatedCatalogs,
+                    cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
+                    allProjects,
+                    ...policyUpdates,
+                }),
+            ]);
+        }
+        else if (policyUpdates != null) {
+            // Plain `pnpm install` (no --update, no params) wouldn't otherwise touch
+            // the workspace manifest. Persist the auto-policy patches anyway so any
+            // loose bypass (today: minimumReleaseAgeExclude) remains explicit on
+            // subsequent installs.
+            await updateWorkspaceManifest(opts.workspaceDir ?? opts.dir, policyUpdates);
+        }
     }
     await handleIgnoredBuilds(opts, ignoredBuilds);
     if (opts.linkWorkspacePackages && opts.workspaceDir) {

package/lib/link.js

@@ -69,6 +69,9 @@ This might cause issues in your project. To resolve this, you may use the "file:
     }
 }
 export async function handler(opts, params) {
+    if ((params == null) || (params.length === 0)) {
+        throw new PnpmError('LINK_BAD_PARAMS', 'You must provide a parameter. Usage: pnpm link <dir>');
+    }
     let workspacePackagesArr;
     let workspacePackages;
     if (opts.workspaceDir) {
@@ -87,9 +90,6 @@ export async function handler(opts, params) {
         binsDir: opts.bin,
     });
     const writeProjectManifest = await createProjectManifestWriter(opts.rootProjectManifestDir);
-    if ((params == null) || (params.length === 0)) {
-        throw new PnpmError('LINK_BAD_PARAMS', 'You must provide a parameter. Usage: pnpm link <dir>');
-    }
     const [pkgPaths, pkgNames] = partition((inp) => isFilespec.test(inp), params);
     if (pkgNames.length > 0) {
         throw new PnpmError('LINK_BAD_PARAMS', `Cannot link by package name. Use a relative or absolute path instead, e.g. "pnpm link ./${pkgNames[0]}"`);

package/lib/policyHandlers.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Shape returned by `installing/deps-installer`'s
+ * `collectResolutionPolicyViolations` and the inline accumulator on
+ * the resolveDependencies result. Re-declared locally so the commands
+ * layer can react without depending on the deps-installer's private
+ * install types.
+ *
+ * Verifier codes (today: `MINIMUM_RELEASE_AGE_VIOLATION` and
+ * `TRUST_DOWNGRADE`) are the contract surface for downstream UX.
+ * Each `PolicyHandler` below filters violations by code to decide
+ * what to do with them (prompt, persist to an exclude list, log,
+ * abort).
+ */
+export interface PolicyViolation {
+    name: string;
+    version: string;
+    code: string;
+    reason: string;
+}
+/**
+ * Workspace-manifest patch a per-policy handler can request. Each
+ * field maps to a `pnpm-workspace.yaml` exclude-list array; the
+ * install command forwards these to `updateWorkspaceManifest` so the
+ * workspace writer dedupes and appends them in one pass.
+ *
+ * New policies that want auto-persistence add their field here AND
+ * teach `updateWorkspaceManifest` how to honor it.
+ */
+export interface WorkspaceManifestPolicyUpdates {
+    addedMinimumReleaseAgeExcludes?: string[];
+}
+/**
+ * Aggregated plan the install command consumes. The `handleResolutionPolicyViolations`
+ * call fans out across every registered handler in registration order;
+ * any handler can throw to abort. `pickManifestUpdates` merges the
+ * per-handler patches into one bag so the workspace writer runs once.
+ */
+export interface PolicyHandlersPlan {
+    handleResolutionPolicyViolations: (violations: readonly PolicyViolation[]) => Promise<void>;
+    pickManifestUpdates: (violations: readonly PolicyViolation[]) => WorkspaceManifestPolicyUpdates | undefined;
+}
+export interface PolicyHandlersOptions {
+    minimumReleaseAge?: number;
+    minimumReleaseAgeStrict?: boolean;
+    /**
+     * Pass `false` for `--no-save` installs. Handlers that would
+     * persist to the workspace manifest refuse to enter modes where
+     * approval is durably required (today: strict minimumReleaseAge)
+     * so the prompt never offers an action it can't honor.
+     */
+    save?: boolean;
+    /**
+     * Override for CI detection. Defaults to `ci-info`'s `isCI` flag.
+     */
+    ci?: boolean;
+}
+/**
+ * Composes the per-policy handlers the install command needs for the
+ * current opts. Returns `undefined` only when no handler reports
+ * activity — saves the install command an empty no-op call at every
+ * checkpoint when no policies are configured.
+ *
+ * Today only the minimumReleaseAge handler is registered. Future
+ * policies (trustPolicy UX, license policy, etc.) plug in by
+ * exporting a sibling `create<Name>PolicyHandler(opts)` and getting
+ * pushed into the `handlers` list below.
+ */
+export declare function setupPolicyHandlers(opts: PolicyHandlersOptions): PolicyHandlersPlan | undefined;

package/lib/policyHandlers.js

@@ -0,0 +1,162 @@
+import { PnpmError } from '@pnpm/error';
+import { globalInfo } from '@pnpm/logger';
+import { MINIMUM_RELEASE_AGE_VIOLATION_CODE } from '@pnpm/resolving.npm-resolver';
+import { isCI } from 'ci-info';
+import enquirer from 'enquirer';
+/**
+ * Composes the per-policy handlers the install command needs for the
+ * current opts. Returns `undefined` only when no handler reports
+ * activity — saves the install command an empty no-op call at every
+ * checkpoint when no policies are configured.
+ *
+ * Today only the minimumReleaseAge handler is registered. Future
+ * policies (trustPolicy UX, license policy, etc.) plug in by
+ * exporting a sibling `create<Name>PolicyHandler(opts)` and getting
+ * pushed into the `handlers` list below.
+ */
+export function setupPolicyHandlers(opts) {
+    const handlers = [];
+    const minimumReleaseAge = createMinimumReleaseAgeHandler(opts);
+    if (minimumReleaseAge)
+        handlers.push(minimumReleaseAge);
+    if (handlers.length === 0)
+        return undefined;
+    return {
+        handleResolutionPolicyViolations: async (violations) => {
+            // Sequential, not parallel: a TTY prompt from handler N would
+            // race with a different prompt from N+1, and we want a clean
+            // throw to short-circuit before later handlers ask for input.
+            for (const handler of handlers) {
+                if (handler.handleResolutionPolicyViolations) {
+                    // eslint-disable-next-line no-await-in-loop
+                    await handler.handleResolutionPolicyViolations(violations);
+                }
+            }
+        },
+        pickManifestUpdates: (violations) => {
+            const merged = {};
+            let any = false;
+            for (const handler of handlers) {
+                if (!handler.pickManifestUpdates)
+                    continue;
+                const patch = handler.pickManifestUpdates(violations);
+                if (patch == null)
+                    continue;
+                // Shallow merge — handlers own disjoint fields by convention,
+                // so there's no collision policy to encode here yet.
+                for (const [key, value] of Object.entries(patch)) {
+                    if (value == null)
+                        continue;
+                    merged[key] = value;
+                    any = true;
+                }
+            }
+            return any ? merged : undefined;
+        },
+    };
+}
+/**
+ * minimumReleaseAge policy handler.
+ *
+ * Loose mode (`minimumReleaseAgeStrict: false`) lets the resolver
+ * install versions newer than the cutoff and auto-persists them to
+ * `minimumReleaseAgeExclude`. Strict mode + an interactive TTY
+ * surfaces the full set of immature picks (direct AND transitive) at
+ * once via a confirm prompt — the install proceeds if the user
+ * approves, otherwise it aborts before touching the lockfile or
+ * package.json (#10488). Strict mode in CI or any other non-TTY
+ * context aborts hard with the same violation list so the failure
+ * pinpoints every offending entry, not just the first one the
+ * resolver picked.
+ *
+ * Strict mode combined with `--no-save` is rejected up-front — the
+ * approval prompt promises persistence the install command's
+ * `opts.save !== false` gate would block, leaving the lockfile
+ * holding approved-but-unlisted immature picks that the next install
+ * would reject.
+ *
+ * Returns `undefined` when minimumReleaseAge is not active.
+ */
+function createMinimumReleaseAgeHandler(opts) {
+    if (!opts.minimumReleaseAge)
+        return undefined;
+    const strictMode = opts.minimumReleaseAgeStrict === true;
+    const persistenceEnabled = opts.save !== false;
+    const inCi = opts.ci ?? isCI;
+    const canPrompt = !inCi && Boolean(process.stdin.isTTY);
+    return {
+        handleResolutionPolicyViolations: async (violations) => {
+            if (!strictMode)
+                return;
+            const immature = filterImmatureViolations(violations);
+            if (immature.length === 0)
+                return;
+            if (!persistenceEnabled) {
+                throw new PnpmError('STRICT_MIN_RELEASE_AGE_REQUIRES_SAVE', 'minimumReleaseAgeStrict cannot be combined with --no-save: ' +
+                    'approval would require writing to minimumReleaseAgeExclude in pnpm-workspace.yaml, ' +
+                    'which --no-save prevents.', {
+                    hint: 'Drop --no-save so the exclude list can be persisted, or set ' +
+                        'minimumReleaseAgeStrict: false to let the install proceed without prompting ' +
+                        '(the lockfile would still trigger the auto-collect on the next normal install).',
+                });
+            }
+            if (canPrompt) {
+                await promptForApproval(immature);
+            }
+            else {
+                throw failOnImmature(immature);
+            }
+        },
+        pickManifestUpdates: (violations) => {
+            const entries = pickImmatureEntries(violations, strictMode);
+            return entries ? { addedMinimumReleaseAgeExcludes: entries } : undefined;
+        },
+    };
+}
+function filterImmatureViolations(violations) {
+    return violations.filter((v) => v.code === MINIMUM_RELEASE_AGE_VIOLATION_CODE);
+}
+function pickImmatureEntries(violations, promptRequired) {
+    const immature = filterImmatureViolations(violations);
+    if (immature.length === 0)
+        return undefined;
+    const sorted = [...new Set(immature.map((v) => `${v.name}@${v.version}`))].sort();
+    // Strict-mode picks already passed through the approval prompt, so
+    // the log here only confirms what was persisted. Loose-mode picks
+    // haven't been announced anywhere else, so the same log doubles as
+    // the discovery notice.
+    const reason = promptRequired
+        ? '(approved at the prompt)'
+        : '(loose mode allowed these immature versions)';
+    globalInfo(`Added ${sorted.length} ${sorted.length === 1 ? 'entry' : 'entries'} to minimumReleaseAgeExclude in pnpm-workspace.yaml ` +
+        `${reason}:\n  ${sorted.join('\n  ')}`);
+    return sorted;
+}
+function failOnImmature(immature) {
+    const sorted = [...immature].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    const list = sorted.map((v) => `  ${v.name}@${v.version} ${v.reason}`).join('\n');
+    return new PnpmError('NO_MATURE_MATCHING_VERSION', `${sorted.length} ${sorted.length === 1 ? 'version does' : 'versions do'} not meet the minimumReleaseAge constraint:\n${list}`, {
+        hint: 'Run the install interactively to approve these picks, or add them to ' +
+            'minimumReleaseAgeExclude in pnpm-workspace.yaml, or wait for the packages ' +
+            'to mature past the configured cutoff.',
+    });
+}
+async function promptForApproval(immature) {
+    const sorted = [...immature].sort((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`));
+    const message = `${sorted.length} ${sorted.length === 1 ? 'version does' : 'versions do'} not meet the minimumReleaseAge constraint:\n` +
+        sorted.map((v) => `  ${v.name}@${v.version}`).join('\n') + '\n' +
+        'Add to minimumReleaseAgeExclude in pnpm-workspace.yaml and proceed with the install?';
+    const answer = await enquirer.prompt({
+        type: 'confirm',
+        name: 'confirmed',
+        message,
+        initial: false,
+    });
+    if (!answer.confirmed) {
+        throw new PnpmError('MINIMUM_RELEASE_AGE_DENIED', 'Aborted: the immature versions were not approved.', {
+            hint: 'Re-run the install without `minimumReleaseAgeStrict: true` to allow these versions, ' +
+                'or wait for the packages to mature past the configured cutoff.',
+        });
+    }
+}
+//# sourceMappingURL=policyHandlers.js.map

package/lib/recursive.d.ts

@@ -2,6 +2,7 @@ import type { CommandHandler } from '@pnpm/cli.command';
 import { type Config, type ConfigContext } from '@pnpm/config.reader';
 import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { PreferredVersions } from '@pnpm/resolving.resolver-base';
+import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { StoreController } from '@pnpm/store.controller';
 import type { IncludedDependencies, Project, ProjectManifest, ProjectsGraph } from '@pnpm/types';
@@ -26,9 +27,10 @@ export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail
     storeControllerAndDir?: {
         ctrl: StoreController;
         dir: string;
+        resolutionVerifiers: ResolutionVerifier[];
     };
     pnpmfile: string[];
-} & Partial<Pick<Config, 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
+} & Partial<Pick<Config, 'ci' | 'sort' | 'strictDepBuilds' | 'workspaceConcurrency'>> & Required<Pick<Config, 'workspaceDir'>>;
 export type CommandFullName = 'install' | 'add' | 'remove' | 'update' | 'import';
 export declare function recursive(allProjects: Project[], params: string[], opts: RecursiveOptions, cmdFullName: CommandFullName): Promise<boolean | string>;
 export declare function matchDependencies(match: (input: string) => string | null, manifest: ProjectManifest, include: IncludedDependencies): string[];

package/lib/recursive.js

@@ -18,6 +18,7 @@ import pLimit from 'p-limit';
 import { getPinnedVersion } from './getPinnedVersion.js';
 import { getSaveType } from './getSaveType.js';
 import { handleIgnoredBuilds } from './handleIgnoredBuilds.js';
+import { setupPolicyHandlers } from './policyHandlers.js';
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies.js';
 export async function recursive(allProjects, params, opts, cmdFullName) {
     if (allProjects.length === 0) {
@@ -33,6 +34,12 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
     const store = opts.storeControllerAndDir ?? await createStoreController(opts);
     const workspacePackages = arrayOfWorkspacePackagesToMap(allProjects);
     const targetDependenciesField = getSaveType(opts);
+    // See `installDeps.ts` for context; mirrored here so workspace-recursive
+    // installs also surface immature picks (loose-mode auto-persist or
+    // strict-mode prompt). The workspace manifest writer dedupes against the
+    // existing list, so a single drain at the end captures additions across
+    // every project.
+    const policyHandlers = setupPolicyHandlers(opts);
     const installOpts = Object.assign(opts, {
         allProjects: getAllProjects(manifestsByPath, opts.allProjectsGraph, opts.sort),
         linkWorkspacePackagesDepth: opts.linkWorkspacePackages === 'deep' ? Infinity : opts.linkWorkspacePackages ? 0 : -1,
@@ -46,7 +53,9 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         storeController: store.ctrl,
         storeDir: store.dir,
         targetDependenciesField,
+        resolutionVerifiers: store.resolutionVerifiers,
         workspacePackages,
+        handleResolutionPolicyViolations: policyHandlers?.handleResolutionPolicyViolations,
     });
     const result = {};
     const projectConfigRecord = createProjectConfigRecord(opts);
@@ -167,11 +176,17 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         if ((mutatedImporters.length === 0) && cmdFullName === 'update' && opts.depth === 0) {
             throw new PnpmError('NO_PACKAGE_IN_DEPENDENCIES', 'None of the specified packages were found in the dependencies of any of the projects.');
         }
-        const { updatedCatalogs, updatedProjects: mutatedPkgs, ignoredBuilds, } = await mutateModules(mutatedImporters, {
+        const { updatedCatalogs, updatedProjects: mutatedPkgs, ignoredBuilds, resolutionPolicyViolations, } = await mutateModules(mutatedImporters, {
             ...installOpts,
             storeController: store.ctrl,
+            resolutionVerifiers: store.resolutionVerifiers,
         });
         if (opts.save !== false) {
+            // Only pick entries when we'll actually persist. Otherwise the
+            // info log would claim entries were added that the workspace
+            // manifest never saw, and the next install would re-prompt or
+            // fail verification.
+            const policyUpdates = policyHandlers?.pickManifestUpdates(resolutionPolicyViolations);
             const promises = mutatedPkgs.map(async ({ originalManifest, manifest, rootDir }) => {
                 return manifestsByPath[rootDir].writeProjectManifest(originalManifest ?? manifest);
             });
@@ -179,6 +194,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                 updatedCatalogs,
                 cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
                 allProjects,
+                ...policyUpdates,
             }));
             await Promise.all(promises);
         }
@@ -188,6 +204,10 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
     const pkgPaths = Object.keys(opts.selectedProjectsGraph).sort();
     let updatedCatalogs;
     const allIgnoredBuilds = new Set();
+    // Each per-project install returns its own slice of lockfile-resolution
+    // violations; accumulate them here so the post-loop persist step can
+    // dedup and write a single batch to the workspace manifest.
+    const allResolutionPolicyViolations = [];
     const limitInstallation = pLimit(getWorkspaceConcurrency(opts.workspaceConcurrency));
     await Promise.all(pkgPaths.map(async (rootDir) => limitInstallation(async () => {
         const hooks = opts.ignorePnpmfile
@@ -239,6 +259,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                             updatedCatalogs: undefined, // there's no reason to add new or update catalogs on `pnpm remove`
                             updatedManifest: mutationResult.updatedProjects[0].manifest,
                             ignoredBuilds: mutationResult.ignoredBuilds,
+                            resolutionPolicyViolations: mutationResult.resolutionPolicyViolations,
                         };
                     };
                     break;
@@ -249,7 +270,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                     break;
             }
             const localConfig = getProjectConfig(manifest) ?? {};
-            const { updatedCatalogs: newCatalogsAddition, updatedManifest: newManifest, ignoredBuilds, } = await action(manifest, {
+            const { updatedCatalogs: newCatalogsAddition, updatedManifest: newManifest, ignoredBuilds, resolutionPolicyViolations, } = await action(manifest, {
                 ...installOpts,
                 ...localConfig,
                 ...opts.allProjectsGraph[rootDir]?.package,
@@ -263,6 +284,7 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                 }),
                 configByUri: installOpts.configByUri,
                 storeController: store.ctrl,
+                resolutionVerifiers: store.resolutionVerifiers,
             });
             if (opts.save !== false) {
                 await writeProjectManifest(newManifest);
@@ -276,6 +298,11 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
                     allIgnoredBuilds.add(depPath);
                 }
             }
+            if (resolutionPolicyViolations?.length) {
+                for (const violation of resolutionPolicyViolations) {
+                    allResolutionPolicyViolations.push(violation);
+                }
+            }
             result[rootDir].status = 'passed';
         }
         catch (err) { // eslint-disable-line
@@ -294,11 +321,18 @@ export async function recursive(allProjects, params, opts, cmdFullName) {
         }
     })));
     await handleIgnoredBuilds(opts, allIgnoredBuilds.size ? allIgnoredBuilds : undefined);
-    await updateWorkspaceManifest(opts.workspaceDir, {
-        updatedCatalogs,
-        cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
-        allProjects,
-    });
+    if (opts.save !== false) {
+        // Only pick entries when we'll actually persist. Otherwise the
+        // info log would claim entries were added that the workspace
+        // manifest never saw, mirroring the gate the shared-lockfile
+        // branch + installDeps already apply.
+        await updateWorkspaceManifest(opts.workspaceDir, {
+            updatedCatalogs,
+            cleanupUnusedCatalogs: opts.cleanupUnusedCatalogs,
+            allProjects,
+            ...policyHandlers?.pickManifestUpdates(allResolutionPolicyViolations),
+        });
+    }
     if (!opts.lockfileOnly && !opts.ignoreScripts && (cmdFullName === 'add' ||
         cmdFullName === 'install' ||
         cmdFullName === 'update')) {

package/lib/remove.js

@@ -135,6 +135,7 @@ export async function handler(opts, params) {
         linkWorkspacePackagesDepth: opts.linkWorkspacePackages === 'deep' ? Infinity : opts.linkWorkspacePackages ? 0 : -1,
         storeController: store.ctrl,
         storeDir: store.dir,
+        resolutionVerifiers: store.resolutionVerifiers,
         include,
     });
     const allProjects = opts.allProjects ?? (opts.workspaceDir

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.2.2",
+  "version": "1100.3.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -33,6 +33,7 @@
     "@zkochan/rimraf": "^4.0.0",
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.0",
+    "ci-info": "^4.3.0",
     "enquirer": "^2.4.1",
     "get-npm-tarball-url": "^2.1.0",
     "is-subdir": "^2.0.0",
@@ -43,45 +44,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1101.0.12",
+    "@pnpm/building.after-install": "1101.0.13",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/cli.command": "1100.0.1",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.4",
-    "@pnpm/config.matcher": "1100.0.1",
     "@pnpm/config.pick-registry-for-package": "1100.0.3",
-    "@pnpm/config.writer": "1100.0.7",
+    "@pnpm/config.matcher": "1100.0.1",
+    "@pnpm/cli.utils": "1101.0.5",
+    "@pnpm/config.writer": "1100.0.8",
+    "@pnpm/deps.status": "1100.0.16",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.inspection.outdated": "1100.0.15",
     "@pnpm/deps.path": "1100.0.3",
-    "@pnpm/deps.status": "1100.0.15",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/error": "1100.0.0",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/global.commands": "1100.0.17",
-    "@pnpm/installing.context": "1100.0.10",
-    "@pnpm/hooks.pnpmfile": "1100.0.8",
-    "@pnpm/installing.dedupe.check": "1100.0.5",
-    "@pnpm/installing.env-installer": "1101.0.9",
-    "@pnpm/installing.deps-installer": "1101.1.2",
-    "@pnpm/lockfile.types": "1100.0.5",
+    "@pnpm/config.reader": "1101.3.2",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/installing.context": "1100.0.11",
+    "@pnpm/global.commands": "1100.0.18",
+    "@pnpm/hooks.pnpmfile": "1100.0.9",
+    "@pnpm/installing.dedupe.check": "1100.0.6",
+    "@pnpm/installing.deps-installer": "1101.2.0",
+    "@pnpm/installing.env-installer": "1101.0.10",
+    "@pnpm/lockfile.types": "1100.0.6",
     "@pnpm/pkg-manifest.reader": "1100.0.3",
-    "@pnpm/pkg-manifest.utils": "1100.1.3",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.resolver-base": "1100.1.3",
-    "@pnpm/store.controller": "1101.0.6",
+    "@pnpm/pkg-manifest.utils": "1100.1.4",
+    "@pnpm/resolving.resolver-base": "1100.2.0",
     "@pnpm/types": "1101.1.0",
-    "@pnpm/workspace.projects-filter": "1100.0.11",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.5",
+    "@pnpm/resolving.npm-resolver": "1101.2.0",
+    "@pnpm/deps.inspection.outdated": "1100.0.16",
+    "@pnpm/store.connection-manager": "1100.2.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.6",
+    "@pnpm/workspace.projects-filter": "1100.0.12",
     "@pnpm/workspace.project-manifest-writer": "1100.0.3",
-    "@pnpm/store.connection-manager": "1100.1.2",
-    "@pnpm/workspace.projects-reader": "1101.0.4",
-    "@pnpm/workspace.state": "1100.0.12",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.7",
+    "@pnpm/store.controller": "1101.0.7",
+    "@pnpm/workspace.projects-graph": "1100.0.9",
     "@pnpm/workspace.projects-sorter": "1100.0.2",
-    "@pnpm/config.reader": "1101.3.1",
-    "@pnpm/workspace.projects-graph": "1100.0.8",
-    "@pnpm/workspace.root-finder": "1100.0.1"
+    "@pnpm/workspace.projects-reader": "1101.0.5",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.8",
+    "@pnpm/workspace.root-finder": "1100.0.1",
+    "@pnpm/workspace.state": "1100.0.13"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -94,7 +96,6 @@
     "@types/ramda": "0.31.1",
     "@types/yarnpkg__lockfile": "^1.1.9",
     "@types/zkochan__table": "npm:@types/table@6.0.0",
-    "ci-info": "^4.3.0",
     "delay": "^7.0.0",
     "jest-diff": "^30.3.0",
     "path-name": "^1.0.0",
@@ -105,18 +106,18 @@
     "write-json-file": "^7.0.0",
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/installing.commands": "1100.2.2",
-    "@pnpm/assert-project": "1100.0.8",
-    "@pnpm/prepare": "1100.0.8",
-    "@pnpm/store.index": "1100.1.0",
-    "@pnpm/logger": "1100.0.0",
+    "@pnpm/assert-project": "1100.0.9",
+    "@pnpm/prepare": "1100.0.9",
+    "@pnpm/installing.commands": "1100.3.0",
     "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/logger": "1100.0.0",
     "@pnpm/test-ipc-server": "1100.0.0",
-    "@pnpm/installing.modules-yaml": "1100.0.4",
     "@pnpm/testing.command-defaults": "1100.0.1",
-    "@pnpm/testing.mock-agent": "1100.0.4",
-    "@pnpm/worker": "1100.1.5",
-    "@pnpm/workspace.projects-filter": "1100.0.11"
+    "@pnpm/testing.mock-agent": "1100.0.5",
+    "@pnpm/store.index": "1100.1.0",
+    "@pnpm/worker": "1100.1.6",
+    "@pnpm/workspace.projects-filter": "1100.0.12",
+    "@pnpm/installing.modules-yaml": "1100.0.4"
   },
   "engines": {
     "node": ">=22.13"