[yuyuyuyuyu-dev]

Projects that install formatters (for README.md, GitHub Actions files, and so on) with pnpm could not run this plugin.

Cause

pnpm init writes devEngines.packageManager: { "name": "pnpm" } into package.json. npm reads it and stops with EBADDEVENGINES for both npm install and npx. The plugin ran both: npmInstall before the build, and npx workbox-cli generateSW after it.

Changes

• The plugin runs npm exec --prefix <empty dir> -- workbox-cli generateSW <config>. The empty folder is build/composepwa/empty-npm-prefix of the module. With --prefix, npm treats that folder as the project, so it does not read the project's package.json, .npmrc, or node_modules. The command itself still runs in the module folder.
• The project's .npmrc is ignored on purpose, so a project cannot change how the plugin behaves. The user's ~/.npmrc still applies, because it holds settings such as a proxy or a private registry, without which npm cannot reach the registry at all.
• --prefix also moves where npm looks for the global npmrc (<global prefix>/etc/npmrc), so that file is not read. This is accepted: it is meant for machines shared by many users, and on a development machine Node.js is usually installed per user (Volta, nvm), where such settings go in ~/.npmrc. Passing it back with --globalconfig would need another npm process to find the file, which is not worth the risk.
• The plugin no longer depends on npmInstall. workbox-cli is fetched by npm exec, so installing the project's own dependencies was never needed.

Why npm only, and not pnpm for pnpm projects

An earlier version of this PR ran pnpm dlx workbox-cli when package.json named pnpm. It was dropped because:

• Running it with pnpm brings no benefit. pnpm saves disk space by sharing files across projects, but npx / npm exec also reuses one cached copy of workbox-cli (~/.npm/_npx/<hash>) across all projects.
• Letting users choose among package managers means testing each one, which raises the maintenance cost far beyond what it gains.

--force was also tried instead of --prefix. It turns the error into a warning, but it disables other npm protections, and npm still looks at the project's node_modules: an old workbox-cli installed there is used instead of the latest one, and one installed only inside another package makes the command fail with "workbox: command not found". --prefix fixes both.

Checks

• Manual builds of test-projects/web-app with Gradle 9.8.2 and npm 12.2.2, wasm and js, with a package.json that names pnpm in devEngines.packageManager (plain npx fails there with EBADDEVENGINES) and a fake workbox-cli in its node_modules: both service workers were generated with the real workbox-cli, no package-lock.json was created, and the empty folder stayed empty.
• The same build with a project .npmrc pointing to a fake registry (ignored, build passes).
• The same build with no package.json, after clean, and again with the configuration cache reused.

Not fixed here

• If package.json also has the packageManager field (for example "pnpm@12.18.0"), the Kotlin Gradle plugin's own kotlinNpmInstall / kotlinWasmNpmInstall fails, because the Yarn 1 it downloads reads that field. This happens without ComposePWA too.

🤖 Generated with Claude Code