Background

#476 wired proxy support through .npmrc and the env-var cascade. pnpm also accepts proxy/TLS values as CLI flags via nopt — see npmConfigTypes.ts for the declared types. Pacquet currently has no CLI-flag layer for these, so users who pass --https-proxy=... get an unknown-flag error.

What to do

1. Decide the CLI surface. Candidates: --proxy, --https-proxy, --http-proxy, --no-proxy, plus (after feat(config,network): TLS keys + local-address from .npmrc #482 lands) --ca, --cafile, --cert, --key, --strict-ssl, --local-address. Mirror pnpm's nopt declarations exactly.
2. Wire them through clap on the shared install args struct. The flags should bind into Config.proxy / Config.tls after the .npmrc + env cascade has run, so CLI > env > .npmrc precedence matches pnpm's config/reader/src/index.ts:591-600 (env is consulted only when neither CLI nor .npmrc set the slot).
3. Tests:
   • Each flag round-trips into the resolved Config.
   • CLI overrides .npmrc (write a tempdir .npmrc with one value, pass a different flag, assert the flag wins).
   • --no-proxy=true literal becomes NoProxySetting::Bypass.
4. Update pnpm.io docs (if pacquet maintains a CLI-flag reference there) — separate.

Out of scope

• npm_config_* env-var fallback for the CLI-style names. pnpm runs CLI flags through nopt which writes npm_config_* env vars; pacquet doesn't go through nopt. Match the resolved behavior, not the env-var mirror.
• Per-registry CLI flags. Doesn't exist upstream.

Depends on

• feat(config,network): TLS keys + local-address from .npmrc #482 (TLS keys) — only if this PR also covers the TLS flag side. The proxy flags can land independently.

Written by an agent (Claude Code, claude-opus-4-7).