@pnpm/installing.commands 1100.4.1 → 1100.5.0

package/lib/add.js

@@ -74,6 +74,7 @@ export function rcOptionsTypes() {
         'side-effects-cache',
         'store-dir',
         'strict-peer-dependencies',
+        'trust-lockfile',
         'trust-policy',
         'trust-policy-exclude',
         'trust-policy-ignore-after',

package/lib/install.d.ts

@@ -7,9 +7,11 @@ export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
 export declare const recursiveByDefault = true;
 export declare function help(): string;
-export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'agent' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
+export type InstallCommandOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'configDependencies' | 'dedupeInjectedDeps' | 'dedupeDirectDeps' | 'dedupePeerDependents' | 'dedupePeers' | 'deployAllFiles' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'engineStrict' | 'excludeLinksFromLockfile' | 'frozenLockfile' | 'global' | 'globalPnpmfile' | 'hoistPattern' | 'publicHoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'injectWorkspacePackages' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'nodeLinker' | 'patchedDependencies' | 'preferFrozenLockfile' | 'preferWorkspacePackages' | 'production' | 'registries' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveCatalogName' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'virtualStoreDir' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'resolutionMode' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'updateConfig' | 'overrides' | 'packageExtensions' | 'agent' | 'supportedArchitectures' | 'packageConfigs'> & Pick<ConfigContext, 'allProjects' | 'cliOptions' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'allProjectsGraph' | 'selectedProjectsGraph'> & CreateStoreControllerOptions & Partial<Pick<Config, 'globalPkgDir'>> & {
     argv: {
+        cooked?: string[];
         original: string[];
+        remain?: string[];
     };
     fixLockfile?: boolean;
     frozenLockfileIfExists?: boolean;

package/lib/install.js

@@ -61,6 +61,7 @@ export function rcOptionsTypes() {
         'side-effects-cache',
         'store-dir',
         'strict-peer-dependencies',
+        'trust-lockfile',
         'trust-policy',
         'trust-policy-exclude',
         'trust-policy-ignore-after',
@@ -220,6 +221,10 @@ by any dependencies, so it is an emulation of a flat node_modules',
                         description: 'Ignore trust downgrades for packages published more than specified minutes ago',
                         name: '--trust-policy-ignore-after <minutes>',
                     },
+                    {
+                        description: 'Trust the lockfile and skip the supply-chain verification step that re-applies minimumReleaseAge / trustPolicy to each lockfile entry. Use only when the lockfile is part of the trusted base (closed-source projects, CI runs against an already-verified lockfile)',
+                        name: '--trust-lockfile',
+                    },
                     {
                         description: 'Clones/hardlinks or copies packages. The selected method depends from the file system',
                         name: '--package-import-method auto',
@@ -282,6 +287,7 @@ export async function handler(opts, _params, commands) {
         include,
         includeDirect: include,
         fetchFullMetadata: getFetchFullMetadata(opts),
+        isInstallCommand: true,
     };
     if (opts.resolutionOnly) {
         installDepsOptions.lockfileOnly = true;

package/lib/installDeps.d.ts

@@ -4,9 +4,11 @@ import { type UpdateMatchingFunction } from '@pnpm/installing.deps-installer';
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { IncludedDependencies, PackageVulnerabilityAudit } from '@pnpm/types';
-export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
+export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin' | 'catalogs' | 'catalogMode' | 'cleanupUnusedCatalogs' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'dev' | 'enableGlobalVirtualStore' | 'virtualStoreOnly' | 'engineStrict' | 'excludeLinksFromLockfile' | 'global' | 'globalPnpmfile' | 'ignoreCurrentSpecifiers' | 'ignorePnpmfile' | 'ignoreScripts' | 'optimisticRepeatInstall' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'agent' | 'production' | 'preferWorkspacePackages' | 'registries' | 'runtime' | 'runtimeOnFail' | 'save' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'scriptsPrependNodePath' | 'scriptShell' | 'sideEffectsCache' | 'sideEffectsCacheReadonly' | 'sort' | 'sharedWorkspaceLockfile' | 'shellEmulator' | 'tag' | 'trustLockfile' | 'allowBuilds' | 'optional' | 'workspaceConcurrency' | 'workspaceDir' | 'workspacePackagePatterns' | 'extraEnv' | 'ignoreWorkspaceCycles' | 'disallowWorkspaceCycles' | 'configDependencies' | 'packageExtensions' | 'updateConfig'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'cliOptions' | 'hooks' | 'rootProjectManifestDir' | 'rootProjectManifest' | 'selectedProjectsGraph'> & Partial<Pick<Config, 'ci'>> & CreateStoreControllerOptions & {
     argv: {
+        cooked?: string[];
         original: string[];
+        remain?: string[];
     };
     allowNew?: boolean;
     forceFullResolution?: boolean;
@@ -39,5 +41,12 @@ export type InstallDepsOptions = Pick<Config, 'autoInstallPeers' | 'bail' | 'bin
     rebuildHandler?: CommandHandler;
     pnpmfile: string[];
     packageVulnerabilityAudit?: PackageVulnerabilityAudit;
+    /**
+     * `true` when this call originated from `pnpm install` (or `pnpm i`),
+     * `false`/`undefined` for `add`, `update`, `dedupe`, etc. Used to gate
+     * which pnpm CLI flags are safe to forward to pacquet's `install`
+     * subcommand — see `runPacquet.ts`'s `noRuntime` opt.
+     */
+    isInstallCommand?: boolean;
 } & Partial<Pick<Config, 'pnpmHomeDir' | 'strictDepBuilds'>>;
 export declare function installDeps(opts: InstallDepsOptions, params: string[]): Promise<void>;

package/lib/installDeps.js

@@ -76,7 +76,8 @@ export async function installDeps(opts, params) {
         ? makeRunPacquet({
             lockfileDir: opts.lockfileDir ?? opts.dir,
             packageName: pacquetConfigDepName,
-            argv: opts.argv.original,
+            argv: { original: opts.argv.original, remain: opts.argv.remain ?? [] },
+            isInstallCommand: opts.isInstallCommand === true,
         })
         : undefined;
     const includeDirect = opts.includeDirect ?? {

package/lib/recursive.d.ts

@@ -6,7 +6,7 @@ import type { ResolutionVerifier } from '@pnpm/resolving.resolver-base';
 import { type CreateStoreControllerOptions } from '@pnpm/store.connection-manager';
 import type { StoreController } from '@pnpm/store.controller';
 import type { IncludedDependencies, Project, ProjectManifest, ProjectsGraph } from '@pnpm/types';
-export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail' | 'configDependencies' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'globalPnpmfile' | 'hoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'agent' | 'allowBuilds' | 'registries' | 'runtime' | 'save' | 'saveCatalogName' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sharedWorkspaceLockfile' | 'tag' | 'cleanupUnusedCatalogs' | 'packageConfigs' | 'updateConfig'> & Pick<ConfigContext, 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir'> & {
+export type RecursiveOptions = CreateStoreControllerOptions & Pick<Config, 'bail' | 'configDependencies' | 'dedupePeerDependents' | 'dedupePeers' | 'depth' | 'globalPnpmfile' | 'hoistPattern' | 'ignorePnpmfile' | 'ignoreScripts' | 'linkWorkspacePackages' | 'lockfileDir' | 'lockfileOnly' | 'modulesDir' | 'agent' | 'allowBuilds' | 'registries' | 'runtime' | 'save' | 'saveCatalogName' | 'saveDev' | 'saveExact' | 'saveOptional' | 'savePeer' | 'savePrefix' | 'saveProd' | 'saveWorkspaceProtocol' | 'lockfileIncludeTarballUrl' | 'sharedWorkspaceLockfile' | 'tag' | 'trustLockfile' | 'cleanupUnusedCatalogs' | 'packageConfigs' | 'updateConfig'> & Pick<ConfigContext, 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir'> & {
     rebuildHandler?: CommandHandler;
     include?: IncludedDependencies;
     includeDirect?: IncludedDependencies;

package/lib/remove.d.ts

@@ -6,7 +6,7 @@ export declare const cliOptionsTypes: () => Record<string, unknown>;
 export declare function help(): string;
 export declare const commandNames: string[];
 export declare const completion: CompletionFunc;
-export declare function handler(opts: CreateStoreControllerOptions & Pick<Config, 'bail' | 'bin' | 'configDependencies' | 'dev' | 'engineStrict' | 'globalPnpmfile' | 'ignorePnpmfile' | 'linkWorkspacePackages' | 'lockfileDir' | 'optional' | 'production' | 'registries' | 'saveDev' | 'saveOptional' | 'saveProd' | 'workspaceDir' | 'workspacePackagePatterns' | 'sharedWorkspaceLockfile' | 'cleanupUnusedCatalogs'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'selectedProjectsGraph'> & {
+export declare function handler(opts: CreateStoreControllerOptions & Pick<Config, 'bail' | 'bin' | 'configDependencies' | 'dev' | 'engineStrict' | 'globalPnpmfile' | 'ignorePnpmfile' | 'linkWorkspacePackages' | 'lockfileDir' | 'optional' | 'production' | 'registries' | 'saveDev' | 'saveOptional' | 'saveProd' | 'workspaceDir' | 'workspacePackagePatterns' | 'sharedWorkspaceLockfile' | 'cleanupUnusedCatalogs' | 'trustLockfile'> & Pick<ConfigContext, 'allProjects' | 'allProjectsGraph' | 'hooks' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'selectedProjectsGraph'> & {
     recursive?: boolean;
     pnpmfile: string[];
 } & Partial<Pick<Config, 'global' | 'globalPkgDir'>>, params: string[]): Promise<void>;

package/lib/runPacquet.d.ts

@@ -10,26 +10,42 @@ export interface MakeRunPacquetOpts {
      */
     packageName: 'pacquet' | '@pnpm/pacquet';
     /**
-     * The user's original `pnpm` argv (`process.argv.slice(2)`). Not
-     * forwarded to pacquet — we only inspect it to warn about flags
+     * The parsed pnpm argv from `@pnpm/cli.parse-cli-args` — `original`
+     * preserves the user's exact tokens (so `--key=value` stays joined,
+     * which pacquet's `--config.<key>=<value>` parser requires), and
+     * `remain` lists the positionals (the `install`/`i` command token
+     * among them). When `isInstallCommand` is true we forward
+     * `original` minus positionals to pacquet's own `install`
+     * subcommand; otherwise we only inspect it to warn about flags
      * pacquet won't see.
      */
-    argv: string[];
+    argv: {
+        original: string[];
+        remain: string[];
+    };
+    /**
+     * `true` when the user invoked `pnpm install` (or `pnpm i`). Gates
+     * flag forwarding: pacquet's `install` subcommand mirrors pnpm's
+     * surface closely enough that the user's flags are safe to pass
+     * along on that command, but not from `add`/`update`/`dedupe` (whose
+     * own flag surface doesn't line up with pacquet's `install`).
+     */
+    isInstallCommand: boolean;
 }
 /**
  * Build the install-engine callback `mutateModules` invokes when
- * `configDependencies` declares pacquet. Returns `undefined` when no
- * pacquet binary is on disk — the caller falls back to the JS path in
- * that case.
+ * `configDependencies` declares pacquet.
  *
  * The callback spawns the pacquet binary installed under
- * `node_modules/.pnpm-config/pacquet` and forwards the user's own
- * pnpm CLI flags. Pacquet's NDJSON stderr is parsed line-by-line and
- * the valid JSON records are re-emitted on pnpm's global
- * `streamParser` so `@pnpm/cli.default-reporter` renders pacquet's
- * events the same way it renders pnpm's own. Non-JSON stderr lines
- * (panic backtraces, unexpected diagnostics) are forwarded to the
- * real stderr verbatim so they reach the user.
+ * `node_modules/.pnpm-config/pacquet`. From `pnpm install`/`pnpm i` it
+ * forwards the user's own pnpm CLI flags to pacquet's `install`
+ * subcommand; from `add`/`update`/`dedupe` it doesn't forward (warning
+ * instead). Pacquet's NDJSON stderr is parsed line-by-line and the
+ * valid JSON records are re-emitted on pnpm's global `streamParser` so
+ * `@pnpm/cli.default-reporter` renders pacquet's events the same way it
+ * renders pnpm's own. Non-JSON stderr lines (panic backtraces,
+ * unexpected diagnostics) are forwarded to the real stderr verbatim so
+ * they reach the user.
  */
 /** Args the deps-installer passes per pacquet invocation. */
 export interface RunPacquetCallOpts {

package/lib/runPacquet.js

@@ -14,15 +14,27 @@ const streamParserWritable = streamParser;
 export function makeRunPacquet(opts) {
     return async (callOpts) => {
         const pacquetBin = resolvePacquetBin(opts.lockfileDir, opts.packageName);
-        // Always the same fixed args. We don't forward pnpm's CLI flags
-        // even though pacquet's `install` subcommand mirrors most of them:
-        // pnpm has commands like `add` and `update` that carry flags
-        // pacquet's `install` doesn't recognize (e.g., `--save-dev`,
-        // `--save-peer`), and clap would reject them. The settings users
-        // care about live in `pnpm-workspace.yaml` / `.npmrc`, which
-        // pacquet reads on its own.
-        const args = ['--reporter=ndjson', 'install', '--frozen-lockfile'];
-        const droppedFlags = collectDroppedFlags(opts.argv);
+        // From `pnpm install`/`pnpm i` we forward the user's flags through to
+        // pacquet's own `install` subcommand verbatim — pacquet mirrors pnpm's
+        // surface closely enough on that command that they're safe to pass
+        // along. From `add`/`update`/`dedupe` we don't forward anything: those
+        // commands carry flags pacquet's `install` doesn't recognize
+        // (`--save-dev`, `--save-peer`, etc.) which clap would reject. Either
+        // way pacquet picks up the settings users care about from
+        // `pnpm-workspace.yaml` / `.npmrc` on its own, so a non-install
+        // delegation isn't broken by the omission.
+        const forwardedFlags = opts.isInstallCommand ? collectForwardedFlags(opts.argv) : [];
+        // `--ignore-manifest-check` tells pacquet to skip its per-importer
+        // `package.json` ↔ `pnpm-lock.yaml` freshness gate. pnpm just
+        // resolved and wrote the lockfile itself; on `pnpm up` / `add` /
+        // `remove` the manifest on disk is still the pre-mutation copy
+        // (pnpm writes it after `mutateModules` returns), so pacquet's own
+        // check would always fire here. See
+        // https://github.com/pnpm/pnpm/issues/11797. The flag is narrow
+        // (only the manifest check); settings drift like `overrides` is
+        // still enforced and was already re-validated by pnpm.
+        const args = ['--reporter=ndjson', 'install', '--frozen-lockfile', '--ignore-manifest-check', ...forwardedFlags];
+        const droppedFlags = opts.isInstallCommand ? [] : collectDroppedFlags(opts.argv);
         if (droppedFlags.length > 0) {
             logger.warn({
                 message: `The following CLI flags are not forwarded to pacquet and may not be honored: ${droppedFlags.join(' ')}. Move the equivalent settings into pnpm-workspace.yaml (or .npmrc for auth/registry) if pacquet needs them.`,
@@ -99,28 +111,103 @@ function resolvePacquetBin(lockfileDir, packageName) {
     return createRequire(pacquetPkg).resolve(`@pacquet/${process.platform}-${process.arch}/pacquet${ext}`);
 }
 /**
- * Pull the CLI flags out of pnpm's argv so we can warn about them
- * before pacquet runs. We don't forward any of them — pacquet always
- * gets `install --frozen-lockfile --reporter=ndjson` — but most are
- * handled by pnpm itself before delegation (`--save-dev` rewrites
- * `package.json`, `--filter` selects projects, etc.) so listing them
- * to the user makes the "not forwarded" surface concrete.
+ * From `pnpm install`/`pnpm i`, return everything in argv that should
+ * ride along to pacquet's own `install` subcommand. Drops the
+ * positionals nopt classified (`install` / `i`, plus anything users
+ * typed positionally) since pacquet's `install` doesn't accept any —
+ * leaving them in produces `error: unexpected argument 'install'
+ * found`. Pacquet's clap parser walks the same `--prod`, `--dev`,
+ * `--no-optional`, `--no-runtime`, `--node-linker`, `--offline`,
+ * `--prefer-offline`, `--cpu`, `--os`, `--libc`, `--frozen-lockfile`
+ * surface pnpm itself accepts on `install`, so the flags don't need
+ * reshaping.
  *
- * Flags we explicitly emit ourselves (`--frozen-lockfile`,
- * `--reporter=ndjson`) are filtered out: they're honored, so warning
- * about them would be misleading. `--config.*` is filtered too —
- * those configure pnpm's runtime and aren't intended for the install
- * engine.
+ * Flags we always inject ourselves (`--frozen-lockfile`,
+ * `--ignore-manifest-check`) are dropped in every form the user can
+ * type them — positive (`--frozen-lockfile`), negated
+ * (`--no-frozen-lockfile`), and any `=value` form. Pacquet's clap
+ * defines these as plain `#[clap(long)] bool` flags, so a duplicate
+ * `--frozen-lockfile` or a conflicting `--no-frozen-lockfile`
+ * crashes the parser with "used multiple times" / "unexpected
+ * argument". The user's `--no-frozen-lockfile` intent is already
+ * honored upstream (pnpm did a fresh resolve before delegating);
+ * pacquet's role here is just lockfile-driven materialization.
+ *
+ * `--reporter` is stripped in any form (`--reporter=foo`,
+ * `--reporter foo`): pacquet's `reporter` is a clap value option
+ * with last-value-wins semantics, so a user-supplied value would
+ * override our `--reporter=ndjson` and break the
+ * NDJSON-to-streamParser plumbing the default reporter relies on.
+ */
+function collectForwardedFlags(argv) {
+    const result = [];
+    // `argv.remain` is the ordered subsequence of positionals nopt
+    // extracted from `original`. Match by index rather than by value so
+    // an option's value that happens to equal a positional (e.g.
+    // `--node-linker install`) isn't mistaken for the positional itself.
+    let positionalIdx = 0;
+    for (let i = 0; i < argv.original.length; i++) {
+        const arg = argv.original[i];
+        if (positionalIdx < argv.remain.length && arg === argv.remain[positionalIdx]) {
+            positionalIdx++;
+            continue;
+        }
+        if (isAlwaysInjected(arg))
+            continue;
+        if (arg.startsWith('--reporter='))
+            continue;
+        if (arg === '--reporter') {
+            // Consume the next token as the reporter value (`--reporter foo`).
+            i++;
+            continue;
+        }
+        result.push(arg);
+    }
+    return result;
+}
+const ALWAYS_INJECTED_FLAGS = ['frozen-lockfile', 'ignore-manifest-check'];
+function isAlwaysInjected(arg) {
+    for (const name of ALWAYS_INJECTED_FLAGS) {
+        if (arg === `--${name}` || arg === `--no-${name}`)
+            return true;
+        if (arg.startsWith(`--${name}=`) || arg.startsWith(`--no-${name}=`))
+            return true;
+    }
+    return false;
+}
+/**
+ * From a non-install command (`add`, `update`, `dedupe`, ...), pull the
+ * CLI flags out of pnpm's argv so we can warn that pacquet won't see
+ * them. They're still handled by pnpm itself before delegation
+ * (`--save-dev` rewrites `package.json`, `--filter` selects projects,
+ * etc.) so listing them to the user makes the "not forwarded" surface
+ * concrete.
+ *
+ * Flags pnpm itself honors before delegation are filtered out —
+ * warning about them would be misleading: `--frozen-lockfile` and
+ * `--ignore-manifest-check` in every shape (positive / negated /
+ * `=value`); `--reporter` in every shape (`--reporter=foo`,
+ * `--reporter foo`); and `--config.*` (configures pnpm's runtime,
+ * not the install engine).
  */
 function collectDroppedFlags(argv) {
-    return argv.filter((arg) => {
+    const result = [];
+    for (let i = 0; i < argv.original.length; i++) {
+        const arg = argv.original[i];
         if (!arg.startsWith('-'))
-            return false;
-        if (arg === '--frozen-lockfile' || arg === '--reporter=ndjson')
-            return false;
+            continue;
+        if (isAlwaysInjected(arg))
+            continue;
         if (arg.startsWith('--config.'))
-            return false;
-        return true;
-    });
+            continue;
+        if (arg.startsWith('--reporter='))
+            continue;
+        if (arg === '--reporter') {
+            i++;
+            continue;
+        }
+        result.push(arg);
+    }
+    return result;
 }
 //# sourceMappingURL=runPacquet.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.commands",
-  "version": "1100.4.1",
+  "version": "1100.5.0",
   "description": "Commands for installation",
   "keywords": [
     "pnpm",
@@ -44,46 +44,46 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "version-selector-type": "^3.0.0",
-    "@pnpm/building.after-install": "1101.0.15",
+    "@pnpm/building.after-install": "1101.0.16",
     "@pnpm/catalogs.types": "1100.0.0",
     "@pnpm/cli.command": "1100.0.1",
+    "@pnpm/cli.utils": "1101.0.7",
     "@pnpm/cli.common-cli-options-help": "1100.0.1",
-    "@pnpm/cli.utils": "1101.0.6",
     "@pnpm/config.matcher": "1100.0.1",
     "@pnpm/config.pick-registry-for-package": "1100.0.5",
-    "@pnpm/config.reader": "1101.3.3",
-    "@pnpm/config.writer": "1100.0.9",
-    "@pnpm/deps.inspection.outdated": "1100.1.1",
+    "@pnpm/config.reader": "1101.4.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.4",
+    "@pnpm/config.writer": "1100.0.9",
     "@pnpm/error": "1100.0.0",
+    "@pnpm/deps.inspection.outdated": "1100.1.2",
     "@pnpm/fs.graceful-fs": "1100.1.0",
-    "@pnpm/deps.status": "1100.0.17",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/global.commands": "1100.0.20",
+    "@pnpm/global.commands": "1100.0.21",
+    "@pnpm/deps.status": "1100.0.18",
     "@pnpm/hooks.pnpmfile": "1100.0.10",
+    "@pnpm/deps.path": "1100.0.4",
     "@pnpm/installing.context": "1100.0.12",
     "@pnpm/installing.dedupe.check": "1100.0.7",
-    "@pnpm/installing.deps-installer": "1101.3.1",
+    "@pnpm/installing.deps-installer": "1101.4.0",
+    "@pnpm/installing.env-installer": "1101.1.2",
     "@pnpm/lockfile.types": "1100.0.7",
-    "@pnpm/installing.env-installer": "1101.1.1",
     "@pnpm/pkg-manifest.reader": "1100.0.4",
     "@pnpm/pkg-manifest.utils": "1100.2.0",
-    "@pnpm/resolving.npm-resolver": "1101.3.1",
+    "@pnpm/resolving.npm-resolver": "1101.3.2",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
     "@pnpm/resolving.resolver-base": "1100.3.0",
-    "@pnpm/store.connection-manager": "1100.2.2",
+    "@pnpm/store.connection-manager": "1100.2.3",
     "@pnpm/store.controller": "1101.0.8",
     "@pnpm/types": "1101.1.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.7",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.8",
     "@pnpm/workspace.project-manifest-writer": "1100.0.4",
-    "@pnpm/workspace.projects-filter": "1100.0.14",
-    "@pnpm/workspace.projects-graph": "1100.0.11",
-    "@pnpm/workspace.projects-reader": "1101.0.6",
+    "@pnpm/workspace.projects-filter": "1100.0.15",
+    "@pnpm/workspace.projects-reader": "1101.0.7",
     "@pnpm/workspace.projects-sorter": "1100.0.3",
-    "@pnpm/workspace.root-finder": "1100.0.1",
-    "@pnpm/workspace.state": "1100.0.14",
-    "@pnpm/workspace.workspace-manifest-writer": "1100.0.9"
+    "@pnpm/workspace.projects-graph": "1100.0.12",
+    "@pnpm/workspace.state": "1100.0.15",
+    "@pnpm/workspace.workspace-manifest-writer": "1100.0.9",
+    "@pnpm/workspace.root-finder": "1100.0.1"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0"
@@ -107,7 +107,7 @@
     "write-package": "7.2.0",
     "write-yaml-file": "^6.0.0",
     "@pnpm/assert-project": "1100.0.10",
-    "@pnpm/installing.commands": "1100.4.1",
+    "@pnpm/installing.commands": "1100.5.0",
     "@pnpm/logger": "1100.0.0",
     "@pnpm/prepare": "1100.0.10",
     "@pnpm/installing.modules-yaml": "1100.0.5",
@@ -117,7 +117,7 @@
     "@pnpm/testing.command-defaults": "1100.0.1",
     "@pnpm/testing.mock-agent": "1100.0.6",
     "@pnpm/worker": "1100.1.7",
-    "@pnpm/workspace.projects-filter": "1100.0.14"
+    "@pnpm/workspace.projects-filter": "1100.0.15"
   },
   "engines": {
     "node": ">=22.13"