fix: add pnpm v11 workaround flags to CLI install flags (workspace yaml not read by all code paths)

Author: jdalton

scripts/npm/install-npm-packages.mjs

@@ -753,14 +753,28 @@ async function installPackage(packageInfo) {
 
     // pnpm v11 ignores overrides in package.json pnpm.overrides for subdependencies
     // (regression from v10). Overrides in pnpm-workspace.yaml still work.
-    // Write overrides to pnpm-workspace.yaml for pnpm, or package.json for npm.
-    if (packageManager === 'pnpm' && Object.keys(pnpmOverrides).length > 0) {
+    // Also set pnpm v11 settings in workspace yaml since CLI --config flags
+    // may not override workspace-level settings.
+    if (packageManager === 'pnpm') {
       const overrideLines = Object.entries(pnpmOverrides)
         .map(([pkg, spec]) => `  ${pkg}: '${spec}'`)
         .join('\n')
+      const overridesSection =
+        Object.keys(pnpmOverrides).length > 0
+          ? `\noverrides:\n${overrideLines}\n`
+          : ''
       await fs.writeFile(
         path.join(packageTempDir, 'pnpm-workspace.yaml'),
-        `packages:\n  - .\n\noverrides:\n${overrideLines}\n`,
+        [
+          'packages:',
+          '  - .',
+          '',
+          '# pnpm v11 settings for third-party test installs.',
+          'blockExoticSubdeps: false',
+          'strictDepBuilds: false',
+          'resolutionMode: highest',
+          overridesSection,
+        ].join('\n'),
         'utf8',
       )
     } else if (packageManager === 'npm') {

scripts/utils/package.mjs

@@ -30,9 +30,18 @@ const PNPM_NPM_LIKE_FLAGS = [
 ]
 
 // Basic pnpm install flags for CI-friendly behavior.
+// These are for isolated test installs of third-party packages we don't control.
 const PNPM_INSTALL_BASE_FLAGS = [
+  // Allow git-resolved subdeps in third-party packages (e.g. evalmd → markdown-it).
+  '--config.block-exotic-subdeps=false',
   // Prevent interactive prompts in CI environments.
   '--config.confirmModulesPurge=false',
+  // Tell pnpm the registry may not have time metadata (SFW proxy strips it).
+  '--config.registry-supports-time-field=false',
+  // Use highest resolution to avoid time-based resolution failures.
+  '--config.resolution-mode=highest',
+  // Allow third-party build scripts (e.g. core-js, es5-ext postinstall).
+  '--config.strict-dep-builds=false',
   // Allow lockfile updates (required for test package installations).
   '--no-frozen-lockfile',
 ]