@superblocksteam/vite-plugin-file-sync 2.0.167-next.0 → 2.0.168-next.0

package/dist/ai-service/app-interface/shell.js

@@ -34,7 +34,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
 };
 import { isUtf8 } from "node:buffer";
 import { exec, execFile } from "node:child_process";
-import { readFile as fsReadFile, mkdir, writeFile, access, rm, stat, readdir, } from "node:fs/promises";
+import { readFile as fsReadFile, mkdir, writeFile, access, rm, stat, readdir, mkdtemp, copyFile, } from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { promisify } from "node:util";
 import { metrics } from "@opentelemetry/api";
@@ -53,12 +54,14 @@ import { ToolExecutionError } from "../agent/tools2/types.js";
 import llmobs from "../llmobs/index.js";
 import { fixLucideDynamicTypeImports, isFixableLucidePath, } from "../transform/lucide-dynamic-type-imports/transformer.js";
 import { NpmInstallBlocked, NpmInstallError, scrubSecrets, } from "../types.js";
+import { detectAppPackageManager, isPnpmEnabled, podPnpmEnv, } from "./app-package-manager.js";
 import { execCancellable } from "./cancellable-exec.js";
 import { CLARK_APP_BLACKLIST_PATTERNS, APPLICATION_FILE_PATTERNS, STANDARD_IGNORE_PATTERNS, } from "./constants.js";
 import { DraftManager, validateFileOperation, } from "./filesystem/index.js";
 import { Linter } from "./linter.js";
-import { parseNpmJsonDiagnostic, parseNpmJsonError, parseNpmJsonSuccess, } from "./npm-error-parser.js";
+import { classifyNpmExecStderr, parseNpmJsonDiagnostic, parseNpmJsonError, parseNpmJsonSuccess, } from "./npm-error-parser.js";
 import { prepareForPrivateRegistry, shouldIgnoreInstallScripts, } from "./npm-registry.js";
+import { readPnpmLockfile } from "./pnpm-lockfile.js";
 import { parseTypecheckOutputByPath } from "./typecheck-output-parser.js";
 import { applyPackageSubstitutions, runVulnerabilityGate, } from "./vulnerability-gate.js";
 const execPromise = promisify(exec);
@@ -71,6 +74,16 @@ const execFilePromise = promisify(execFile);
 // covers real-world npm summaries (per-package entries are tiny) while
 // keeping the worst-case buffer + parsed-object peak bounded.
 const NPM_JSON_MAX_BUFFER = 4 * 1024 * 1024;
+/**
+ * Flags that keep an install from running the app's own code when the org
+ * disallows install scripts. pnpm also runs `.pnpmfile.cjs` / `.pnpmfile.mjs`
+ * hooks, which `--ignore-scripts` does not stop.
+ */
+function ignoreScriptsFlags(packageManager) {
+    return packageManager === "pnpm" && isPnpmEnabled()
+        ? ["--ignore-scripts", "--ignore-pnpmfile"]
+        : ["--ignore-scripts"];
+}
 /** Lowest version a declared range admits; skips `workspace:`/`file:`/`*`/git. */
 function declaredRangeFloor(range) {
     if (range == null || semver.validRange(range) == null)
@@ -720,13 +733,14 @@ let AppShell = (() => {
          * raw registry hostname or token cannot reach an exported attribute even
          * if an upstream caller forgot to scrub.
          */
-        observeNpmInstall(runner, registryFetchResult, outcome, durationMs) {
+        observeNpmInstall(runner, registryFetchResult, outcome, durationMs, packageManager) {
             const tags = recordNpmInstall({
                 runner,
                 registryHost: registryUrlFromFetchResult(registryFetchResult),
                 outcome,
                 configured: registryFetchResult?.config.configured ?? false,
                 durationMs,
+                packageManager,
             });
             // Record whether `--ignore-scripts` was added for this install on the span
             // only, not as a metric label: the question is "did this one install skip
@@ -872,6 +886,7 @@ let AppShell = (() => {
                 await this.maybePreparePackageJsonForCloudNpm();
                 await this.applyDeclaredDependencyUpgrades(await this.maybeRemediateVulnerabilities({
                     abortSignal,
+                    ignoreScripts: shouldIgnoreInstallScripts(registryFetchResult),
                     mode: "all",
                 }));
             });
@@ -884,18 +899,61 @@ let AppShell = (() => {
          * uses (`buildInstallEnv` in the SDK). These execs otherwise inherit
          * `process.env` implicitly, so we spread it before adding the override.
          * pnpm has no equivalent logs-dir config and ignores the var (npm-only).
+         * In the pod pnpm also gets the same settings as the startup install (see
+         * `podPnpmEnv`); npm ignores those vars. Local dev keeps the developer's own
+         * store and build approvals.
          */
         installLogEnv() {
             return {
                 ...process.env,
                 NPM_CONFIG_LOGS_DIR: path.join(this.appRootDirPath, ".superblocks", "logs"),
+                ...(process.env.SUPERBLOCKS_SERVER_ENV === "local" || !isPnpmEnabled()
+                    ? {}
+                    : podPnpmEnv(this.appRootDirPath)),
             };
         }
         /**
-         * Cloud edit pods force npm for agent-driven installs. npm rejects pnpm's
-         * `workspace:` protocol, so rewrite platform deps and strip any remaining
-         * workspace entries before spawning npm (APPS-3752 bootstrap does this on
-         * pod start; migration restructure and agent installs need the same guard).
+         * The package manager for agent-driven installs. Local dev (csb mock server)
+         * keeps pnpm, to stay out of the surrounding workspace's lockfile and store.
+         * Cloud edit asks `detectAppPackageManager`, the same decision the
+         * dev server's startup install makes, so the two never mix a pnpm
+         * node_modules with an npm install.
+         */
+        async appPackageManager() {
+            if (process.env.SUPERBLOCKS_SERVER_ENV === "local") {
+                return "pnpm";
+            }
+            return detectAppPackageManager(this.appRootDirPath);
+        }
+        /**
+         * The package manager for `runPackageManagerInstall` and
+         * `installSpecificPackages`. While pnpm is off, local dev detects the app's
+         * package manager, as these two did before pnpm support. Everything else is
+         * `appPackageManager`.
+         */
+        async installingPackageManager() {
+            if (isPnpmEnabled() || process.env.SUPERBLOCKS_SERVER_ENV !== "local") {
+                return this.appPackageManager();
+            }
+            const detected = await detect({
+                strategies: [
+                    "packageManager-field",
+                    "lockfile",
+                    "install-metadata",
+                    "devEngines-field",
+                ],
+                cwd: this.appRootDirPath,
+            });
+            if (!detected) {
+                throw new Error("Could not detect package manager");
+            }
+            return detected.agent;
+        }
+        /**
+         * npm rejects pnpm's `workspace:` protocol, so in the pod rewrite platform
+         * deps and strip any remaining workspace entries before an install (APPS-3752
+         * bootstrap does this on pod start; migration restructure and agent installs
+         * need the same guard).
          */
         async maybePreparePackageJsonForCloudNpm() {
             if (process.env.SUPERBLOCKS_SERVER_ENV === "local") {
@@ -910,6 +968,7 @@ let AppShell = (() => {
             const installStart = Date.now();
             let outcome = "success";
             let capturedFetchResult;
+            let capturedPackageManager;
             try {
                 // `withAuthFailedRetry` owns the `.npmrc` materialization (via
                 // `prepareForPrivateRegistry`) and the one-shot auth_failed retry —
@@ -925,22 +984,22 @@ let AppShell = (() => {
                     await this.maybePreparePackageJsonForCloudNpm();
                     const appliedSubstitutions = await this.applyDeclaredDependencyUpgrades(await this.maybeRemediateVulnerabilities({
                         abortSignal,
+                        ignoreScripts: shouldIgnoreInstallScripts(registryFetchResult),
                         mode: "all",
                     }));
                     const ignoreScripts = shouldIgnoreInstallScripts(registryFetchResult);
-                    const isNpm = process.env.SUPERBLOCKS_SERVER_ENV !== "local";
+                    capturedPackageManager = await this.appPackageManager();
+                    const isNpm = capturedPackageManager === "npm";
                     // prepare already ran above so Mode 2 cloud dry-run sees semver deps.
-                    // In csb mock server (local dev) we use pnpm to avoid lockfile / store
-                    // conflicts with the surrounding workspace; everywhere else we force npm
-                    // so the `--json` error contract — and therefore the registry-blocked
-                    // advice matrix — applies on this post-processing path too. When the
-                    // org has opted out via `allow_install_scripts=false`, append
-                    // `--ignore-scripts` (the flag is honored by both npm and pnpm).
+                    // When the org has opted out via `allow_install_scripts=false`, append
+                    // `--ignore-scripts` (and `--ignore-pnpmfile` for pnpm, see `ignoreScriptsFlags`).
                     const baseCommand = isNpm
                         ? "npm install --fund=false --audit=false --json"
-                        : "pnpm install --config.confirmModulesPurge=false";
+                        : isPnpmEnabled()
+                            ? "pnpm install --no-frozen-lockfile"
+                            : "pnpm install";
                     const command = ignoreScripts
-                        ? `${baseCommand} --ignore-scripts`
+                        ? `${baseCommand} ${ignoreScriptsFlags(capturedPackageManager).join(" ")}`
                         : baseCommand;
                     await new Promise((resolve, reject) => {
                         exec(command, {
@@ -956,14 +1015,12 @@ let AppShell = (() => {
                                 // Route the npm path through the same classifier as the agent-tool
                                 // install entry points so E404 / E401 / ENOTFOUND surface as a
                                 // `NpmInstallBlocked` (with row-aware advice) instead of a raw
-                                // `NpmInstallError(stderr)`. The pnpm path doesn't emit the
-                                // `--json` envelope, so the classifier falls through to the
-                                // legacy error for it — registry-blocked scenarios only matter
-                                // in cloud-edit (which is the npm branch).
-                                if (isNpm) {
-                                    return reject(this.classifyNpmExecError({ stdout, stderr, message: error.message }, undefined, registryFetchResult));
-                                }
-                                return reject(new NpmInstallError(stderr));
+                                // `NpmInstallError(stderr)`. pnpm has no `--json` envelope, so
+                                // its classifier reads pnpm's plain output instead.
+                                const failure = { stdout, stderr, message: error.message };
+                                return reject(isNpm
+                                    ? this.classifyNpmExecError(failure, undefined, registryFetchResult)
+                                    : this.classifyPnpmExecError(failure, undefined, registryFetchResult));
                             }
                             return resolve();
                         });
@@ -979,7 +1036,7 @@ let AppShell = (() => {
                 throw err;
             }
             finally {
-                this.observeNpmInstall("install_all", capturedFetchResult, outcome, Date.now() - installStart);
+                this.observeNpmInstall("install_all", capturedFetchResult, outcome, Date.now() - installStart, capturedPackageManager);
             }
         }
         /**
@@ -1078,7 +1135,7 @@ let AppShell = (() => {
          * rewrite). Local stays floors-only — pnpm + lingering `workspace:*` mean
          * full-tree coverage is not available there.
          */
-        async resolveInstallTree(mode, packages, abortSignal) {
+        async resolveInstallTree(mode, packages, abortSignal, ignoreScripts) {
             if (mode === "all") {
                 const topLevel = [];
                 for (const pkg of packages ?? []) {
@@ -1093,7 +1150,7 @@ let AppShell = (() => {
                 const fromLock = await this.readPackagesFromPackageLock();
                 let dryTree = [];
                 try {
-                    dryTree = (await this.resolveTreeViaNpmDryRun([], abortSignal)).tree;
+                    dryTree = (await this.resolveTreeViaNpmDryRun([], abortSignal, ignoreScripts)).tree;
                 }
                 catch (err) {
                     // Do not continue remediation after cancel.
@@ -1113,7 +1170,7 @@ let AppShell = (() => {
                 return { resolves: true, topLevel, tree: [...byKey.values()] };
             }
             const specs = (packages ?? []).map((pkg) => pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name);
-            const resolved = await this.resolveTreeViaNpmDryRun(specs, abortSignal);
+            const resolved = await this.resolveTreeViaNpmDryRun(specs, abortSignal, ignoreScripts);
             // Prefer dry-run concrete pins for top-level. Never inject the raw
             // requested range/`latest` string into the lookup tree — the index
             // keys on concrete versions, and a range would fail coverage checks.
@@ -1149,9 +1206,13 @@ let AppShell = (() => {
                 tree: [...byKey.values()],
                 topLevel,
                 resolves: resolved.resolves,
+                unnamed: resolved.unnamed,
             };
         }
-        async resolveTreeViaNpmDryRun(specs, abortSignal) {
+        async resolveTreeViaNpmDryRun(specs, abortSignal, ignoreScripts) {
+            if (isPnpmEnabled() && (await this.appPackageManager()) === "pnpm") {
+                return this.resolveTreeViaPnpmLockfile(specs, abortSignal, ignoreScripts);
+            }
             const args = [
                 "install",
                 "--dry-run",
@@ -1202,6 +1263,72 @@ let AppShell = (() => {
                 throw error;
             }
         }
+        /**
+         * pnpm's dry run for the install security check. npm's `--dry-run` crashes
+         * on a node_modules that pnpm laid out, and pnpm has no dry run of its own,
+         * so this resolves in a throwaway copy of the app's manifest and lockfile
+         * with `--lockfile-only` (nothing downloaded or linked) and reads the tree
+         * pnpm wrote. That is exactly what the real install will pick, overrides and
+         * all. Any pnpm failure counts as "does not resolve", as for npm's error
+         * envelope, so the check never vouches for a tree it couldn't see.
+         */
+        async resolveTreeViaPnpmLockfile(specs, abortSignal, ignoreScripts) {
+            const dir = await mkdtemp(path.join(os.tmpdir(), "sb-pnpm-resolve-"));
+            try {
+                for (const file of [
+                    "package.json",
+                    "pnpm-lock.yaml",
+                    "pnpm-workspace.yaml",
+                    ".npmrc",
+                    // The real install runs the app's pnpmfile hooks, which can add
+                    // dependencies, so the check has to run them too. Unless the org
+                    // disallows install scripts: then no install runs them.
+                    ...(ignoreScripts ? [] : [".pnpmfile.cjs", ".pnpmfile.mjs"]),
+                ]) {
+                    await copyFile(path.join(this.appRootDirPath, file), path.join(dir, file)).catch(() => undefined);
+                }
+                // `--` so a spec that looks like an option (`--registry=…`) is read as
+                // a package name, as in the npm dry run. execFile, so no shell either.
+                // `--ignore-scripts` always: resolving the tree needs no builds.
+                const flags = [
+                    "--lockfile-only",
+                    ...(ignoreScripts ? ignoreScriptsFlags("pnpm") : ["--ignore-scripts"]),
+                ];
+                const args = specs.length > 0
+                    ? ["add", ...flags, "--", ...specs]
+                    : // The lockfile has to be allowed to change, as on the real
+                        // install. pnpm 12 already allows that with `--lockfile-only`
+                        // under `CI=true`; the flag says so outright. `pnpm add` rejects it.
+                        ["install", ...flags, "--no-frozen-lockfile"];
+                await execFilePromise("pnpm", args, {
+                    cwd: dir,
+                    env: this.installLogEnv(),
+                    signal: abortSignal,
+                    maxBuffer: NPM_JSON_MAX_BUFFER,
+                });
+                const locked = readPnpmLockfile(await fsReadFile(path.join(dir, "pnpm-lock.yaml"), "utf8"));
+                if (!locked)
+                    return { tree: [], topLevel: [], resolves: false };
+                // A tarball or git package already in the app's lockfile is already
+                // installed; only the ones this install adds are new.
+                const installed = new Set((await this.readPackagesFromPackageLock())?.unnamed);
+                return {
+                    ...locked,
+                    unnamed: locked.unnamed.filter((key) => !installed.has(key)),
+                    resolves: true,
+                };
+            }
+            catch (error) {
+                if (abortSignal?.aborted ||
+                    (error instanceof Error && error.name === "AbortError")) {
+                    throw error;
+                }
+                return { tree: [], topLevel: [], resolves: false };
+            }
+            finally {
+                await rm(dir, { recursive: true, force: true });
+            }
+        }
         treeFromNpmDryRunJson(parsed, specs) {
             if (parsed == null || typeof parsed !== "object") {
                 return { tree: [], topLevel: [], resolves: true };
@@ -1257,6 +1384,12 @@ let AppShell = (() => {
             return { tree, topLevel, resolves: true };
         }
         async readPackagesFromPackageLock() {
+            // A pnpm app's installed tree is in `pnpm-lock.yaml`; a `package-lock.json`
+            // left over from its npm days would describe packages pnpm never installs.
+            if (isPnpmEnabled() && (await this.appPackageManager()) === "pnpm") {
+                const locked = readPnpmLockfile(await fsReadFile(path.join(this.appRootDirPath, "pnpm-lock.yaml"), "utf8").catch(() => ""));
+                return locked ? { ...locked, resolves: true } : null;
+            }
             const lockPath = path.join(this.appRootDirPath, "package-lock.json");
             let raw;
             try {
@@ -1332,7 +1465,7 @@ let AppShell = (() => {
          * No-op when `packageLookup` is unwired. Index failures → malware fail-closed.
          */
         async maybeRemediateVulnerabilities(args) {
-            const { abortSignal, cveUserOverride, mode } = args;
+            const { abortSignal, cveUserOverride, ignoreScripts, mode } = args;
             if (!this.packageLookup) {
                 return { substitutions: [] };
             }
@@ -1348,8 +1481,8 @@ let AppShell = (() => {
                         getLogger().warn(message, getErrorMeta(error));
                     },
                     pickQuarantineHoldback: this.packageLookup.pickQuarantineHoldback,
-                    resolveInstallTree: async (resolveArgs) => await this.resolveInstallTree(resolveArgs.mode, resolveArgs.packages, resolveArgs.abortSignal),
-                    resolvePackageSpecs: async (resolveArgs) => await this.resolveTreeViaNpmDryRun(resolveArgs.specs, resolveArgs.abortSignal),
+                    resolveInstallTree: async (resolveArgs) => await this.resolveInstallTree(resolveArgs.mode, resolveArgs.packages, resolveArgs.abortSignal, ignoreScripts),
+                    resolvePackageSpecs: async (resolveArgs) => await this.resolveTreeViaNpmDryRun(resolveArgs.specs, resolveArgs.abortSignal, ignoreScripts),
                 },
                 cveUserOverride,
                 mode,
@@ -1398,9 +1531,8 @@ let AppShell = (() => {
          *   pre-existing handler (e.g. agent-planning's POST_PROCESSING_ERRORED
          *   branch) behaves exactly as it did before.
          *
-         * Only used on the npm code path; pnpm continues to throw `NpmInstallError`
-         * directly because pnpm's `--json` error contract differs and the
-         * registry-blocked scenarios only matter in cloud-edit (which forces npm).
+         * Only used on the npm code path; pnpm failures go through
+         * `classifyPnpmExecError`.
          *
          * `registryFetchResult` carries the most recent
          * `prepareForPrivateRegistry` result so the structured error can encode
@@ -1466,6 +1598,29 @@ let AppShell = (() => {
             }
             return new NpmInstallError(diagnostic || error.stderr || error.message || "");
         }
+        /**
+         * pnpm's counterpart to `classifyNpmExecError`. pnpm has no `--json` error
+         * output, so this reads its plain-text error. pnpm 12 writes that to stderr,
+         * pnpm 10 and older to stdout, so both are read. A registry failure
+         * (`ERR_PNPM_FETCH_401` and friends) becomes an `NpmInstallBlocked`, which
+         * gives the agent the same advice and auth retry as npm. Anything else keeps
+         * pnpm's own message instead of an empty one.
+         */
+        classifyPnpmExecError(error, requestedPackages, registryFetchResult) {
+            // While pnpm is off, a pnpm failure keeps its stderr as it did before.
+            if (!isPnpmEnabled()) {
+                return new NpmInstallError(error.stderr || error.message || "");
+            }
+            const output = `${error.stdout ?? ""}\n${error.stderr ?? ""}`.trim();
+            const blocked = classifyNpmExecStderr(output, {
+                requestedPackages,
+                hasAnyRegistryConfigured: AppShell.deriveHasAnyRegistryConfigured(registryFetchResult),
+            });
+            // The message reaches the agent, and pnpm's output can echo a registry
+            // URL with its token in it.
+            return (blocked ??
+                new NpmInstallError(scrubSecrets(output || error.message || "")));
+        }
         /**
          * Wraps an install attempt so that a `registry_auth_failed` failure
          * triggers one cache-invalidation + re-fetch + retry cycle before
@@ -1502,80 +1657,69 @@ let AppShell = (() => {
             const installStart = Date.now();
             let outcome = "success";
             let capturedFetchResult;
+            let capturedPackageManager;
             try {
                 return await this.withAuthFailedRetry(async (registryFetchResult) => {
                     capturedFetchResult = registryFetchResult;
                     // APPS-4370: short-circuit before any exec when server is unreachable
                     // AND this org's marker says it was previously configured.
                     this.maybeShortCircuitForUnreachable(registryFetchResult, []);
-                    // In cloud edit mode, always use npm because pnpm is not available in the container.
-                    // The user's project may have pnpm signals (pnpm-lock.yaml, packageManager field)
-                    // from local editing, but we must use npm in cloud mode.
-                    const isCloudMode = process.env.SUPERBLOCKS_SERVER_ENV !== "local";
-                    let packageManagerAgent;
-                    if (isCloudMode) {
-                        // Force npm in cloud mode; prepare before Mode 2 so dry-run malware
-                        // scan does not choke on workspace: protocol entries.
-                        packageManagerAgent = "npm";
-                        await this.maybePreparePackageJsonForCloudNpm();
-                    }
-                    else {
-                        // NOTE: this largely duplicates the logic in the CLI
-                        const packageManager = await detect({
-                            strategies: [
-                                "packageManager-field",
-                                "lockfile",
-                                "install-metadata",
-                                "devEngines-field",
-                            ],
-                            cwd: this.appRootDirPath,
-                        });
-                        if (!packageManager) {
-                            throw new Error("Could not detect package manager");
-                        }
-                        packageManagerAgent = packageManager.agent;
-                    }
+                    // Cloud edit uses npm unless the app is a pnpm app and pnpm is on for
+                    // the org (see `appPackageManager`).
+                    const packageManagerAgent = await this.installingPackageManager();
+                    // Prepare before Mode 2 so the dry-run malware scan does not choke on
+                    // workspace: protocol entries. pnpm in the pod needs it as much as
+                    // npm: the app is a single project there, so `workspace:*` has
+                    // nothing to resolve to. A no-op in local dev.
+                    await this.maybePreparePackageJsonForCloudNpm();
+                    capturedPackageManager = packageManagerAgent;
                     const appliedSubstitutions = await this.applyDeclaredDependencyUpgrades(await this.maybeRemediateVulnerabilities({
                         abortSignal,
+                        ignoreScripts: shouldIgnoreInstallScripts(registryFetchResult),
                         mode: "all",
                     }));
                     const ignoreScripts = shouldIgnoreInstallScripts(registryFetchResult);
                     const isNpm = packageManagerAgent === "npm";
+                    // pnpm: the lockfile has to be allowed to change, as for `npm
+                    // install`; pnpm would otherwise refuse under `CI=true`.
                     const baseInstallArgs = isNpm
                         ? ["--fund=false", "--audit=false", "--json"]
-                        : [];
+                        : packageManagerAgent === "pnpm" && isPnpmEnabled()
+                            ? ["--no-frozen-lockfile"]
+                            : [];
                     const installArgs = ignoreScripts
-                        ? [...baseInstallArgs, "--ignore-scripts"]
+                        ? [...baseInstallArgs, ...ignoreScriptsFlags(packageManagerAgent)]
                         : baseInstallArgs;
                     const installCommand = resolveCommand(packageManagerAgent, "install", installArgs);
                     if (!installCommand) {
                         throw new Error(`Could not determine install command for ${packageManagerAgent}, skipping package installation`);
                     }
                     const { command, args } = installCommand;
+                    let stdout;
                     try {
-                        const { stdout } = await execPromise(`${command} ${args.join(" ")}`, {
+                        ({ stdout } = await execPromise(`${command} ${args.join(" ")}`, {
                             cwd: this.appRootDirPath,
                             env: this.installLogEnv(),
                             signal: abortSignal,
                             // See `NPM_JSON_MAX_BUFFER` — `--json` summary can outgrow the
                             // default 1 MiB exec buffer on fat dep trees.
                             maxBuffer: NPM_JSON_MAX_BUFFER,
-                        });
-                        // Audit only after the install succeeds (same as Mode 1).
-                        this.maybeReportSubstitutions(appliedSubstitutions, "install_all");
-                        // On the npm path stdout is a JSON blob; translate to a compact
-                        // human-readable summary for the agent, falling back to raw stdout
-                        // when the JSON shape drifts.
-                        if (isNpm) {
-                            return parseNpmJsonSuccess(stdout) ?? stdout;
-                        }
-                        return stdout;
+                        }));
                     }
                     catch (error) {
                         if (isNpm)
                             throw this.classifyNpmExecError(error, undefined, registryFetchResult);
-                        throw new NpmInstallError(error.stderr || error.message);
+                        throw this.classifyPnpmExecError(error, undefined, registryFetchResult);
+                    }
+                    // Audit only after the install succeeds (same as Mode 1).
+                    this.maybeReportSubstitutions(appliedSubstitutions, "install_all");
+                    // On the npm path stdout is a JSON blob; translate to a compact
+                    // human-readable summary for the agent, falling back to raw stdout
+                    // when the JSON shape drifts.
+                    if (isNpm) {
+                        return parseNpmJsonSuccess(stdout) ?? stdout;
                     }
+                    return stdout;
                 });
             }
             catch (err) {
@@ -1584,7 +1728,7 @@ let AppShell = (() => {
                 throw err;
             }
             finally {
-                this.observeNpmInstall("install_all", capturedFetchResult, outcome, Date.now() - installStart);
+                this.observeNpmInstall("install_all", capturedFetchResult, outcome, Date.now() - installStart, capturedPackageManager);
             }
         }
         async installSpecificPackages(packages, abortSignal, options) {
@@ -1608,6 +1752,7 @@ let AppShell = (() => {
             const installStart = Date.now();
             let outcome = "success";
             let capturedFetchResult;
+            let capturedPackageManager;
             try {
                 return await this.withAuthFailedRetry(async (registryFetchResult) => {
                     capturedFetchResult = registryFetchResult;
@@ -1616,37 +1761,19 @@ let AppShell = (() => {
                     // surfaces them to the agent ("we tried to install lodash and the
                     // private registry was unreachable").
                     this.maybeShortCircuitForUnreachable(registryFetchResult, packages.map((pkg) => pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name));
-                    // In cloud edit mode, always use npm because pnpm is not available in the container.
-                    // The user's project may have pnpm signals (pnpm-lock.yaml, packageManager field)
-                    // from local editing, but we must use npm in cloud mode. Prepare before the
-                    // Mode 1 dry-run so leftover workspace: entries cannot break malware coverage.
-                    const isCloudMode = process.env.SUPERBLOCKS_SERVER_ENV !== "local";
-                    let packageManagerAgent;
-                    if (isCloudMode) {
-                        // Force npm in cloud mode
-                        packageManagerAgent = "npm";
-                        await this.maybePreparePackageJsonForCloudNpm();
-                    }
-                    else {
-                        const packageManager = await detect({
-                            strategies: [
-                                "packageManager-field",
-                                "lockfile",
-                                "install-metadata",
-                                "devEngines-field",
-                            ],
-                            cwd: this.appRootDirPath,
-                        });
-                        if (!packageManager) {
-                            throw new Error("Could not detect package manager");
-                        }
-                        packageManagerAgent = packageManager.agent;
-                    }
+                    // Cloud edit uses npm unless the app is a pnpm app and pnpm is on for
+                    // the org (see `appPackageManager`). Prepare before the Mode 1 dry-run
+                    // so leftover workspace: entries cannot break malware coverage, for
+                    // pnpm as well as npm (see `runPackageManagerInstall`).
+                    const packageManagerAgent = await this.installingPackageManager();
+                    await this.maybePreparePackageJsonForCloudNpm();
+                    capturedPackageManager = packageManagerAgent;
                     // Malware hard-block on the dry-run resolved tree (top-level +
                     // transitive) before the real install runs. Mode 1 also returns
                     // silent CVE substitutions applied to the install argv below.
                     const remediation = await this.maybeRemediateVulnerabilities({
                         abortSignal,
+                        ignoreScripts: shouldIgnoreInstallScripts(registryFetchResult),
                         cveUserOverride: options?.cveUserOverride,
                         mode: "specific",
                         packages,
@@ -1664,7 +1791,9 @@ let AppShell = (() => {
                         const baseArgs = isNpm
                             ? ["--fund=false", "--audit=false", "--json", ...packageSpecs]
                             : packageSpecs;
-                        const addCommand = resolveCommand(packageManagerAgent, "add", ignoreScripts ? ["--ignore-scripts", ...baseArgs] : baseArgs);
+                        const addCommand = resolveCommand(packageManagerAgent, "add", ignoreScripts
+                            ? [...ignoreScriptsFlags(packageManagerAgent), ...baseArgs]
+                            : baseArgs);
                         if (!addCommand) {
                             throw new Error(`Could not determine add command for ${packageManagerAgent}`);
                         }
@@ -1683,7 +1812,7 @@ let AppShell = (() => {
                         catch (error) {
                             if (isNpm)
                                 throw this.classifyNpmExecError(error, regularPackages, registryFetchResult);
-                            throw new NpmInstallError(error.stderr || error.message);
+                            throw this.classifyPnpmExecError(error, regularPackages, registryFetchResult);
                         }
                     }
                     // Install dev dependencies
@@ -1698,7 +1827,9 @@ let AppShell = (() => {
                                 ...packageSpecs,
                             ]
                             : ["-D", ...packageSpecs];
-                        const addCommand = resolveCommand(packageManagerAgent, "add", ignoreScripts ? ["--ignore-scripts", ...baseArgs] : baseArgs);
+                        const addCommand = resolveCommand(packageManagerAgent, "add", ignoreScripts
+                            ? [...ignoreScriptsFlags(packageManagerAgent), ...baseArgs]
+                            : baseArgs);
                         if (!addCommand) {
                             throw new Error(`Could not determine add command for ${packageManagerAgent}`);
                         }
@@ -1717,7 +1848,7 @@ let AppShell = (() => {
                         catch (error) {
                             if (isNpm)
                                 throw this.classifyNpmExecError(error, devPackages, registryFetchResult);
-                            throw new NpmInstallError(error.stderr || error.message);
+                            throw this.classifyPnpmExecError(error, devPackages, registryFetchResult);
                         }
                     }
                     // Audit only after every install group succeeds: a selected
@@ -1744,7 +1875,7 @@ let AppShell = (() => {
                 throw err;
             }
             finally {
-                this.observeNpmInstall("install_specific", capturedFetchResult, outcome, Date.now() - installStart);
+                this.observeNpmInstall("install_specific", capturedFetchResult, outcome, Date.now() - installStart, capturedPackageManager);
             }
         }
         async uninstallPackages(packages, options) {
@@ -1765,6 +1896,7 @@ let AppShell = (() => {
             const installStart = Date.now();
             let outcome = "success";
             let capturedFetchResult;
+            let capturedPackageManager;
             // Uninstalls hit the same registry resolution rules as installs (the
             // dependency-tree solver re-reifies the remaining tree and can re-fetch
             // metadata), so they run through the SAME safety wrapper as every
@@ -1799,13 +1931,14 @@ let AppShell = (() => {
                     // surrounding workspace); npm everywhere else so the `--json` error
                     // contract — and therefore the registry-blocked advice matrix —
                     // applies. Mirrors `runNpmInstall` / `installSpecificPackages`.
-                    const isNpm = process.env.SUPERBLOCKS_SERVER_ENV !== "local";
+                    capturedPackageManager = await this.appPackageManager();
+                    const isNpm = capturedPackageManager === "npm";
                     const packageManager = isNpm ? "npm" : "pnpm";
                     const uninstallCmd = isNpm ? "uninstall" : "remove";
-                    const jsonFlag = isNpm ? " --json" : "";
-                    const baseCommand = `${packageManager} ${uninstallCmd} ${packages.join(" ")}${jsonFlag}`;
+                    const flags = isNpm ? " --json" : "";
+                    const baseCommand = `${packageManager} ${uninstallCmd} ${packages.join(" ")}${flags}`;
                     const command = ignoreScripts
-                        ? `${baseCommand} --ignore-scripts`
+                        ? `${baseCommand} ${ignoreScriptsFlags(packageManager).join(" ")}`
                         : baseCommand;
                     return await new Promise((resolve, reject) => {
                         exec(command, {
@@ -1822,12 +1955,12 @@ let AppShell = (() => {
                                 // `NpmInstallBlocked` (with row-aware advice + the
                                 // auth-failed retry signal consumed by `withAuthFailedRetry`);
                                 // anything else falls back to the legacy `NpmInstallError`.
-                                // pnpm doesn't emit the `--json` envelope, so it keeps the
-                                // raw-stderr error.
-                                if (isNpm) {
-                                    return reject(this.classifyNpmExecError({ stdout, stderr, message: error.message }, undefined, registryFetchResult));
-                                }
-                                return reject(new NpmInstallError(stderr || error.message));
+                                // pnpm has no `--json` envelope, so its classifier reads
+                                // pnpm's plain output instead.
+                                const failure = { stdout, stderr, message: error.message };
+                                return reject(isNpm
+                                    ? this.classifyNpmExecError(failure, undefined, registryFetchResult)
+                                    : this.classifyPnpmExecError(failure, undefined, registryFetchResult));
                             }
                             // On the npm path stdout is a `--json` blob; collapse it to a
                             // compact human-readable summary (same as
@@ -1849,7 +1982,7 @@ let AppShell = (() => {
                 throw err;
             }
             finally {
-                this.observeNpmInstall("uninstall", capturedFetchResult, outcome, Date.now() - installStart);
+                this.observeNpmInstall("uninstall", capturedFetchResult, outcome, Date.now() - installStart, capturedPackageManager);
             }
         }
         static MAX_GENERATION_RUNS = 10;