Summary

Tracking issue for installation-related settings supported by the pnpm CLI that the Rust engine does not yet support. This was produced by diffing pnpm's Config type (config/reader/src) against pacquet's config crate, its CLI args, and the rest of the workspace.

Scope is limited to pacquet's command surface for install, add, update, remove. Settings that only affect publish/run/exec/dlx/audit are excluded.

Checklist re-audited 2026-07-25 against the code at d59fb00bc7. Most of the original list had landed in the interim without being ticked here. See the audit comment below for the method and the per-item evidence.

Lockfile

• lockfileOnly / --lockfile-only — resolve + write lockfile without linking (feat(pacquet): port lockfileOnly setting #12046)
• lockfileDir — custom lockfile location
• sharedWorkspaceLockfile — toggle for single root lockfile
• useGitBranchLockfile, gitBranchLockfile, mergeGitBranchLockfiles, mergeGitBranchLockfilesBranchPattern — per-branch lockfiles
• frozenLockfile as a config-file/env setting (feat: support frozenLockfile, savePrefix, savePeer and saveCatalogName settings in the Rust engine #13283)

Resolution / versions

• resolutionMode (highest / time-based / lowest-direct)
• registrySupportsTimeField
• allowedDeprecatedVersions
• updateConfig.ignoreDependencies
• peerDependencyRules (ignoreMissing, allowAny, allowedVersions)

Builds / scripts / hooks

• ignoreScripts
• enablePrePostScripts, scriptShell
• syncInjectedDepsAfterScripts
• onlyBuiltDependencies / onlyBuiltDependenciesFile / neverBuiltDependencies — pacquet uses allowBuilds/dangerouslyAllowAllBuilds instead; deliberate divergence, may never be ported
• strictDepBuilds
• .pnpmfile.cjs hooks are executed (crates/hooks, Node.js runtime, plus config-dependency plugin pnpmfiles)
• pnpmfile, globalPnpmfile, enablePnpmfile, ignorePnpmfile — the settings that select/disable the pnpmfile; the path is currently fixed

Patching

• allowUnusedPatches
• allowNonAppliedPatches
• patchesDir

Store / modules

• virtualStoreOnly
• stateDir
• strictStorePkgContentCheck
• enableModulesDir
• preferSymlinkedExecutables

Network

• networkConcurrency, maxSockets
• fetchingConcurrency
• fetchTimeout
• fetchWarnTimeoutMs, fetchMinSpeedKiBps
• userAgent, npmrcAuthFile

Catalogs

• catalogMode
• cleanupUnusedCatalogs

Workspace

• ignoreWorkspaceCycles / disallowWorkspaceCycles
• includeWorkspaceRoot

Save behavior (add/update)

• savePrefix (feat: support frozenLockfile, savePrefix, savePeer and saveCatalogName settings in the Rust engine #13283)
• saveWorkspaceProtocol (feat: support the saveWorkspaceProtocol setting in the Rust engine #13299)
• savePeer (feat: support frozenLockfile, savePrefix, savePeer and saveCatalogName settings in the Rust engine #13283)
• saveCatalogName (feat: support frozenLockfile, savePrefix, savePeer and saveCatalogName settings in the Rust engine #13283)

Manifest / engine

• engineStrict, nodeVersion (engine-strict gating during install)
• configDependencies

Env-var coverage

Separate from whether a setting exists: pnpm's parseEnvVars exposes every key in its schema as PNPM_CONFIG_<KEY>, while pacquet wires each one explicitly. These are readable from pnpm-workspace.yaml but not from the environment:

• PNPM_CONFIG_VIRTUAL_STORE_ONLY
• PNPM_CONFIG_ENABLE_MODULES_DIR
• PNPM_CONFIG_NPMRC_AUTH_FILE

(allowUnusedPatches, cleanupUnusedCatalogs, and configDependencies are absent from pnpm's types.ts too, so having no env var for them matches pnpm.)

Notes

• enablePnp is not a separate setting in either implementation — pnp is a nodeLinker value, which pacquet already accepts.

Written by an agent (Claude Code, claude-opus-4-8); re-audited by an agent (Claude Code, claude-opus-5[1m]).