Refactor pnpm flags into reusable constants

- Rename PNPM_INSTALL_FLAGS to PNPM_HOISTED_INSTALL_FLAGS for clarity
- Add PNPM_INSTALL_BASE_FLAGS for isolated (non-hoisted) installs
- Use PNPM_INSTALL_BASE_FLAGS for nested package installs to prevent
  JSON corruption from concurrent hoisted installations
- Update all scripts to use the appropriate flag constants

Author: jdalton

scripts/install-npm-packages.mjs

@@ -12,7 +12,11 @@ import { cleanTestScript } from '../test/utils/script-cleaning.mjs'
 import { testRunners } from '../test/utils/test-runners.mjs'
 import { suppressMaxListenersWarning } from './utils/suppress-warnings.mjs'
 import { filterPackagesByChanges } from './utils/git.mjs'
-import { PNPM_INSTALL_ENV, PNPM_INSTALL_FLAGS } from './utils/package.mjs'
+import {
+  PNPM_HOISTED_INSTALL_FLAGS,
+  PNPM_INSTALL_BASE_FLAGS,
+  PNPM_INSTALL_ENV,
+} from './utils/package.mjs'
 import constants from './constants.mjs'
 import ENV from '../registry/dist/lib/constants/ENV.js'
 import spinner from '../registry/dist/lib/constants/spinner.js'
@@ -444,26 +448,18 @@ async function installPackage(packageInfo) {
 
         // Install any missing dependencies.
         // Unset NODE_ENV and CI to prevent pnpm from skipping devDependencies.
-        await runCommand('pnpm', ['install', ...PNPM_INSTALL_FLAGS], {
+        await runCommand('pnpm', ['install', ...PNPM_HOISTED_INSTALL_FLAGS], {
           cwd: packageTempDir,
           env: { ...process.env, ...PNPM_INSTALL_ENV },
         })
 
         // Explicitly install dependencies in the nested package to ensure test
         // runners (tape, mocha, ava, etc.) are available.
         // Use isolated mode (not hoisted) to avoid conflicts with parent installation.
-        await runCommand(
-          'pnpm',
-          [
-            'install',
-            '--config.confirmModulesPurge=false',
-            '--no-frozen-lockfile',
-          ],
-          {
-            cwd: installedPath,
-            env: { ...process.env, ...PNPM_INSTALL_ENV },
-          },
-        )
+        await runCommand('pnpm', ['install', ...PNPM_INSTALL_BASE_FLAGS], {
+          cwd: installedPath,
+          env: { ...process.env, ...PNPM_INSTALL_ENV },
+        })
 
         // Apply Socket overrides to all nested dependencies recursively.
         await applyNestedSocketOverrides(installedPath)
@@ -520,7 +516,7 @@ async function installPackage(packageInfo) {
     // Unset NODE_ENV and CI to prevent pnpm from skipping devDependencies.
     await pRetry(
       async () => {
-        await runCommand('pnpm', ['install', ...PNPM_INSTALL_FLAGS], {
+        await runCommand('pnpm', ['install', ...PNPM_HOISTED_INSTALL_FLAGS], {
           cwd: packageTempDir,
           env: { ...process.env, ...PNPM_INSTALL_ENV },
         })
@@ -741,22 +737,18 @@ async function installPackage(packageInfo) {
 
     // Install dependencies to ensure devDependencies (test runners) are available.
     // Unset NODE_ENV and CI to prevent pnpm from skipping devDependencies.
-    await runCommand('pnpm', ['install', ...PNPM_INSTALL_FLAGS], {
+    await runCommand('pnpm', ['install', ...PNPM_HOISTED_INSTALL_FLAGS], {
       cwd: packageTempDir,
       env: { ...process.env, ...PNPM_INSTALL_ENV },
     })
 
     // Explicitly install dependencies in the nested package to ensure test
     // runners (tape, mocha, ava, etc.) are available.
     // Use isolated mode (not hoisted) to avoid conflicts with parent installation.
-    await runCommand(
-      'pnpm',
-      ['install', '--config.confirmModulesPurge=false', '--no-frozen-lockfile'],
-      {
-        cwd: installedPath,
-        env: { ...process.env, ...PNPM_INSTALL_ENV },
-      },
-    )
+    await runCommand('pnpm', ['install', ...PNPM_INSTALL_BASE_FLAGS], {
+      cwd: installedPath,
+      env: { ...process.env, ...PNPM_INSTALL_ENV },
+    })
 
     // Apply Socket overrides to all nested dependencies recursively.
     await applyNestedSocketOverrides(installedPath)

scripts/run-npm-package-tests.mjs

@@ -11,8 +11,9 @@ import WIN32 from '../registry/dist/lib/constants/WIN32.js'
 import constants from './constants.mjs'
 import { filterPackagesByChanges } from './utils/git.mjs'
 import {
+  PNPM_HOISTED_INSTALL_FLAGS,
+  PNPM_INSTALL_BASE_FLAGS,
   PNPM_INSTALL_ENV,
-  PNPM_INSTALL_FLAGS,
   buildTestEnv,
   runCommand,
 } from './utils/package.mjs'
@@ -121,13 +122,14 @@ async function runPackageTest(socketPkgName) {
         }
 
         // First reinstall in the root (installs prod dependencies of main package).
-        await runCommand('pnpm', ['install', ...PNPM_INSTALL_FLAGS], {
+        await runCommand('pnpm', ['install', ...PNPM_HOISTED_INSTALL_FLAGS], {
           cwd: packageTempDir,
           env,
         })
 
         // Then reinstall all dependencies (including devDependencies) of the nested package.
-        await runCommand('pnpm', ['install', ...PNPM_INSTALL_FLAGS], {
+        // Use isolated mode to avoid conflicts with parent installation.
+        await runCommand('pnpm', ['install', ...PNPM_INSTALL_BASE_FLAGS], {
           cwd: installedPath,
           env,
         })

scripts/utils/package.mjs

@@ -29,15 +29,20 @@ const PNPM_NPM_LIKE_FLAGS = [
   '--config.strict-peer-dependencies=false',
 ]
 
-// Additional pnpm install flags for CI-friendly behavior.
-const PNPM_INSTALL_FLAGS = [
-  ...PNPM_NPM_LIKE_FLAGS,
+// Basic pnpm install flags for CI-friendly behavior.
+const PNPM_INSTALL_BASE_FLAGS = [
   // Prevent interactive prompts in CI environments.
   '--config.confirmModulesPurge=false',
   // Allow lockfile updates (required for test package installations).
   '--no-frozen-lockfile',
 ]
 
+// Pnpm install flags with hoisting for npm-like behavior.
+const PNPM_HOISTED_INSTALL_FLAGS = [
+  ...PNPM_NPM_LIKE_FLAGS,
+  ...PNPM_INSTALL_BASE_FLAGS,
+]
+
 // Environment override to force pnpm to install devDependencies.
 // By default, pnpm skips devDependencies when CI or NODE_ENV=production is detected.
 const PNPM_INSTALL_ENV = { CI: undefined, NODE_ENV: undefined }
@@ -442,7 +447,7 @@ async function installPackageForTesting(socketPkgName) {
     await fs.writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2))
 
     // Install dependencies with pnpm.
-    await runCommand('pnpm', ['install', ...PNPM_INSTALL_FLAGS], {
+    await runCommand('pnpm', ['install', ...PNPM_HOISTED_INSTALL_FLAGS], {
       cwd: installedPath,
     })
 
@@ -466,8 +471,9 @@ export {
   copySocketOverride,
   editablePackageJsonCache,
   installPackageForTesting,
+  PNPM_HOISTED_INSTALL_FLAGS,
+  PNPM_INSTALL_BASE_FLAGS,
   PNPM_INSTALL_ENV,
-  PNPM_INSTALL_FLAGS,
   PNPM_NPM_LIKE_FLAGS,
   processWithSpinner,
   readCachedEditablePackageJson,