Workspace roots may not have a package.json. Use the manifest already
available from config rather than reading from disk.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Pass dir, lockfileDir, modulesDir to install() for correct context
- Throw descriptive error when package.json can't be read
- Add deps-installer and deps-restorer to changeset

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…attern

Use allProjects for correct workspace builds (topological ordering,
all importers walked). Pass hoistPattern/publicHoistPattern as undefined
so buildProjects doesn't overwrite per-project module settings that
were configured during the install phase.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Sort projects via selectedProjectsGraph to assign correct buildIndex
per topological chunk. Destructure out hoistPattern/publicHoistPattern
from opts to prevent buildProjects from overwriting per-project
module settings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Move rebuild handler and recursive rebuild to a new package to break
the circular dependency between installing/commands and
building/commands. Now:
- installing/commands depends on building.rebuild-command (not building.commands)
- building/commands re-exports from building.rebuild-command
- building/commands can depend on installing.deps-installer for GVS

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Only default allowBuilds to {} in extendInstallOptions (the install()
entry point), not in headlessInstall itself. Direct callers like
installPnpm pass enableGlobalVirtualStore: true without allowBuilds
and expect engine-aware hashes. Defaulting in headlessInstall changed
those hashes and broke pnpm version switching.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Fix grammar in --pending help text ("were not built")
- Use path.join for package.json path construction
- Add @pnpm/building.rebuild-command to changeset
- Add README.md for rebuild-command package

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Default allowBuilds to {} in headlessInstall, extendInstallOptions,
  and the config reader when GVS is enabled
- Fix installPnpm to pass allowBuilds: { '@pnpm/exe': true } to both
  findPnpmGvsPath and installFromLockfile so hash computation is
  consistent (exe has platform-specific binaries needing engine hashes)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Ensures add, update, and dedupe handlers forward the rebuild command
so recursive installs trigger the rebuild step.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Required params are not assignable to the Command type which has
commands as optional. Keep it optional in the signature — the CLI
always provides it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Packages with build side-effects cached in the store had isBuilt: true,
causing buildModules to skip them entirely. The allowBuild check was
never reached, so they didn't appear in ignoredBuilds and
strictDepBuilds wouldn't fail.

Now check allowBuild for all packages with requiresBuild that are
already built, adding unapproved ones to ignoredBuilds even though
they don't need rebuilding.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…11035)"

This reverts commit f46f935.

When a package's build approval is revoked (removed from allowBuilds)
after its side-effects were cached in the store, buildModules skips it
(isBuilt: true) and the allowBuild check is never reached.

Fix: in mutateModules, compare the previous allowBuilds (from
.modules.yaml) with the current config. Packages that were previously
approved but are no longer get added to ignoredBuilds, so
strictDepBuilds fails and the warning is shown.

This works across all install paths (fresh, repeat, headless) because
it operates after _install() returns, at the mutateModules level.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Use env override for store dir (CLI args don't override the env var
set by execPnpmSync). Remove debug assertion.

Verified: test passes with fix, fails without it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Write storeDir and other settings to pnpm-workspace.yaml in the test
instead of passing via CLI args or env overrides. Simpler and more
explicit.

Revert the unused storeDir option fix in execPnpmSync since it's no
longer needed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

E2e tests use the bundled dist/pnpm.mjs, not individual package lib/
outputs. Document that pnpm --filter pnpm run compile must be run
after changing any package before running e2e tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Use the same allowBuild function comparison as the rest of the
codebase, which handles version-specific entries, ranges, and
dangerouslyAllowAllBuilds correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Only scan lockfile packages when there are actually revoked names
(uncommon). Build the set of revoked names first from the small
allowBuilds config, then scan the lockfile only if needed.

Also fix comment to accurately describe behavior and simplify
the check to use opts.allowBuilds directly instead of
createAllowBuildFunction.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Packages with build side-effects cached in the store had isBuilt: true,
causing buildModules to filter them out before the allowBuild check.
Now checks allowBuild for all requiresBuild packages with isBuilt: true
in a pre-loop, adding unapproved ones to ignoredBuilds.

This fixes the case where a package like esbuild was built in a previous
project and its side-effects are in the store — a new project that
hasn't approved it now correctly reports it as ignored.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Use createAllowBuildFunction for both old and current allowBuilds
  to correctly handle version-specific entries (e.g. pkg@1.0.0)
- Only add to ignoredBuilds when current result is undefined (undecided),
  not false (explicitly denied), consistent with buildModules behavior
- Short-circuit when no previous allowBuilds entries were true

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Print 'Done! Approved: pkg1, pkg2' after rebuild completes so the
user gets feedback even when the rebuild produces no visible output.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When _rebuild skips a package because its side-effects are already
cached in the store, log 'pkg@version: reused from store cache'.

Also revert the verbose approve-builds messages — the rebuild output
itself is sufficient feedback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

_rebuild now logs what happened to each package:
- 'reused from store cache' when side-effects are cached
- 'skipped (no build scripts)' when requiresBuild is false
- 'skipped (not allowed)' when allowBuild denies it
Packages that run postinstall show their output as before.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace the premature 'running build scripts...' message with a
post-completion 'built successfully' message that only appears
when postinstall hooks actually ran.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When a package has requiresBuild but isBuilt (side-effects cached
in the store), log 'pkg@version: already built (store cache)' so
the user knows why no build scripts ran.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The root cause: when importing packages from the store, side-effects
cache was applied for any package not explicitly denied (allowBuild
!== false). This meant unapproved packages (allowBuild === undefined)
got cached build artifacts, setting isBuilt: true and bypassing the
allowBuild check in buildModules.

Fix: only apply side-effects cache when allowBuild returns true
(explicitly approved). This is checked in three places:
- deps-restorer/src/index.ts (isolated linker)
- deps-restorer/src/linkHoistedModules.ts (hoisted linker)
- deps-installer/src/install/link.ts (non-headless install)

Also add status messages to _rebuild so users see what happened
to each package (built successfully, skipped, reused from cache).

Remove the buildModules pre-loop workaround since it's no longer
needed — unapproved packages now have isBuilt: false.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When buildModules skips a package because it was already imported
with cached side effects (isBuilt: true), print a message so users
know the build was reused from the store.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

buildSelectedPkgs was overwriting .modules.yaml with config-derived
storeDir/virtualStoreDir values instead of preserving the existing
ones from the modules manifest. This caused pnpm install to detect
a mismatch and prompt to reinstall from scratch after approve-builds.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Without this, .modules.yaml had no allowBuilds after approve-builds,
causing the next GVS install to detect a mismatch and reimport all
packages (showing deps as newly added).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace all process.stdout.write calls in _rebuild and buildModules
with globalInfo from @pnpm/logger. Revert approve-builds return vs
await to keep consistent with the GVS path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>