[Bug]: pnpm-global provider updates leave a broken CLI because the command has no --allow-build #20783

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Install OpenCode 2 globally with pnpm 10 or later, approving its build: pnpm add -g @opencode/cli@latest --allow-build=@opencode/cli. opencode --version prints a version and T3 shows OpenCode as available.
2. Run the command T3's "Update now" uses for a pnpm-global install. To reproduce it deterministically, remove the package first, since pnpm skips the install when the version is unchanged: pnpm remove -g @opencode/cli, then pnpm add -g @opencode/cli@latest.
3. Run opencode --version, then refresh the provider list in Settings.

Expected behavior

The update leaves a working CLI. opencode --version prints the new version and OpenCode stays available.

Actual behavior

pnpm exits 0, but the postinstall that puts the platform binary in place never runs. opencode --version prints the package's placeholder instead of a version, and T3 marks OpenCode unavailable:

Failed to execute OpenCode CLI health check: Unable to determine OpenCode version from `opencode --version` output. T3 Code requires OpenCode v1.14.19 or newer.

pnpm 10 and later skip dependency install scripts unless they are approved. The pnpm-global branch in packages/provider-core/src/server/maintenanceResolver.ts builds the command with no approval:

updateArgs: ["add", "-g", `${packageName}@latest`],

The npm branch in the same file already passes --allow-scripts=${packageName}. The pnpm branch has no equivalent. Checked on main at 47683f6.

The user can't approve it once either. pnpm 11 ignores allowBuilds in the global config.yaml and warns that it belongs in a project's pnpm-workspace.yaml, so every global update needs the flag on the command line.

Suggested fix: pass --allow-build=${packageName} in the pnpm-global branch, mirroring the npm branch. #8363 made exactly this change and was closed without being merged, with no reason given in the thread. It notes that --allow-build needs pnpm 10.4 or later and that older pnpm rejects unknown options.

Related but separate: #14249, #14295 and #19580 cover pnpm's minimumReleaseAge picking an older version than the one advertised. #16160 covers an npm update that drops the platform binary during a publish race.

Impact

Blocks work completely

Version or commit

T3 Code Nightly 0.0.46-nightly.20261014; code checked on main @ 47683f6

Environment

Windows 11, pnpm 11.1.3, OpenCode 2.0.30 as @opencode/cli. Also seen on Ubuntu arm64 with pnpm 10.28.1, where installing through opencode upgrade --major --method pnpm left the same placeholder.

Logs or stack traces

$ opencode --version
Error: @opencode/cli's postinstall script was not run.

This occurs when installation scripts are disabled.
Run the package postinstall script or reinstall with scripts enabled.

Workaround

Reinstall by hand with the build approved: pnpm remove -g @opencode/cli, then pnpm add -g @opencode/cli@latest --allow-build=@opencode/cli, then refresh providers in Settings. When the version is unchanged, pnpm add -g reports "Already up to date" and does not rerun the postinstall even with --allow-build, so the remove step is needed.