From d52e7710027165e625b21445b0fce7b88913dcaf Mon Sep 17 00:00:00 2001
From: Angel Angelov <71898342+angelovdev@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:20:02 +0300
Subject: [PATCH 1/2] fix(server): allow install scripts in pnpm-global
 provider updates

pnpm blocks install scripts by default, so a one-click provider update
through pnpm can replace a working global CLI with a broken one and still
report success. Scope an --allow-build allowlist to the package being
updated, matching the npm-global fix in #5646.
---
 .../src/provider/providerMaintenance.test.ts  | 19 +++++++++++++++----
 .../src/provider/providerMaintenance.ts       | 11 ++++++++++-
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/provider/providerMaintenance.test.ts b/apps/server/src/provider/providerMaintenance.test.ts
index 5683da2c1a82..82e1ef195307 100644
--- a/apps/server/src/provider/providerMaintenance.test.ts
+++ b/apps/server/src/provider/providerMaintenance.test.ts
@@ -297,11 +297,17 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => {
           provider: driver("scopedPackageTool"),
           packageName: "@example/scoped-package-tool",
           update: {
-            command: "pnpm add -g @example/scoped-package-tool@latest",
+            command:
+              "pnpm add -g --allow-build=@example/scoped-package-tool @example/scoped-package-tool@latest",
 
             executable: "pnpm",
 
-            args: ["add", "-g", "@example/scoped-package-tool@latest"],
+            args: [
+              "add",
+              "-g",
+              "--allow-build=@example/scoped-package-tool",
+              "@example/scoped-package-tool@latest",
+            ],
 
             lockKey: "pnpm-global",
           },
@@ -536,11 +542,16 @@ it.layer(NodeServices.layer)("providerMaintenance", (it) => {
         provider: driver("packageTool"),
         packageName: "@example/package-tool",
         update: {
-          command: "pnpm add -g @example/package-tool@latest",
+          command: "pnpm add -g --allow-build=@example/package-tool @example/package-tool@latest",
 
           executable: "pnpm",
 
-          args: ["add", "-g", "@example/package-tool@latest"],
+          args: [
+            "add",
+            "-g",
+            "--allow-build=@example/package-tool",
+            "@example/package-tool@latest",
+          ],
 
           lockKey: "pnpm-global",
         },
diff --git a/apps/server/src/provider/providerMaintenance.ts b/apps/server/src/provider/providerMaintenance.ts
index 14d17cf365c3..012a52ae2dda 100644
--- a/apps/server/src/provider/providerMaintenance.ts
+++ b/apps/server/src/provider/providerMaintenance.ts
@@ -171,7 +171,16 @@ function makePnpmGlobalProviderMaintenanceCapabilities(
     provider: definition.provider,
     packageName: definition.npmPackageName,
     updateExecutable: "pnpm",
-    updateArgs: ["add", "-g", `${definition.npmPackageName}@latest`],
+    // pnpm 10+ blocks install scripts by default, so a package whose
+    // postinstall finishes the install (fetching or unpacking its platform
+    // binary) is left broken while the update reports success. Allow this one
+    // package's scripts; the flag needs pnpm 10.4+.
+    updateArgs: [
+      "add",
+      "-g",
+      `--allow-build=${definition.npmPackageName}`,
+      `${definition.npmPackageName}@latest`,
+    ],
     updateLockKey: "pnpm-global",
   });
 }

From f56c567a3367c56f8954077d8b311a7941619f9c Mon Sep 17 00:00:00 2001
From: Angel Angelov <71898342+angelovdev@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:36:30 +0300
Subject: [PATCH 2/2] chore(server): drop comment from pnpm update args

---
 apps/server/src/provider/providerMaintenance.ts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/apps/server/src/provider/providerMaintenance.ts b/apps/server/src/provider/providerMaintenance.ts
index 012a52ae2dda..031b7b19419e 100644
--- a/apps/server/src/provider/providerMaintenance.ts
+++ b/apps/server/src/provider/providerMaintenance.ts
@@ -171,10 +171,6 @@ function makePnpmGlobalProviderMaintenanceCapabilities(
     provider: definition.provider,
     packageName: definition.npmPackageName,
     updateExecutable: "pnpm",
-    // pnpm 10+ blocks install scripts by default, so a package whose
-    // postinstall finishes the install (fetching or unpacking its platform
-    // binary) is left broken while the update reports success. Allow this one
-    // package's scripts; the flag needs pnpm 10.4+.
     updateArgs: [
       "add",
       "-g",