[Aschenbath]

With COREPACK_ENABLE_AUTO_PIN=1, running a package manager can currently modify an existing package.json without confirmation. Ask before adding packageManager when stdin is a terminal and CI is unset, showing the target manifest and resolved version. Only y/yes accepts; refusal, empty input, or EOF leaves the manifest unchanged and still runs the requested command.

Explicitly enabled auto-pinning remains automatic for CI and non-interactive input. The README documents both modes.

Validation on Node.js 24.20.0:

• Build, TypeScript, repository-wide ESLint with --max-warnings=0, and git diff --check passed.
• Nine CLI regressions cover confirmation, refusal, empty/invalid input, EOF, repeat invocation, CI, piped input, and disabled auto-pinning.
• A real PTY check confirmed that declining preserves the manifest and that the package manager can read subsequent terminal input.
• Full Vitest suite in replay mode with retries disabled: 9 files passed; 180 tests passed and 1 existing expected failure (181 total).

The local test runner isolates inherited proxy settings from CLI fixtures while retaining proxy access for the live npm-key check. Temporary fixtures use /var/tmp and compilation caches are disabled because /tmp is capacity-constrained. No tests were skipped or modified for these environment adjustments.

Closes #691.

Implementation and automated validation were performed by Codex.

[aduh95]

This account has opened more than 10 PRs in the last 24 hours. This looks like bot activity, and will result in a ban if the behavior continues.