The controlling errorERR_PNPM_ADDING_TO_ROOT occurs before plugin code is downloaded or executed.

State the intended target.

Documenteddsh plugin --profile web add <package>→Bounded workarounddsh plugin --profile web add -w <package>
Do not disable the safeguard globally.

-w acknowledges this one profile root. It does not audit the package.

Prove four boundaries.

01Dependency

Expected package and version in the profile manifest.

02Materialization

Package resolves from the selected profile.

03Bundle

Only declared bundles join the layer stack.

04Composition

--dump-config shows the intended layer.

Do not merge neighboring failures.

Root targetpnpm missingBuild blockedNo bundle manifestRuntime failure

Primary evidence.

Keep the complete installation runbook.

The canonical guide adds failure routing, full verification, cleanup expectations, and version-spanning regression gates.

Read and star on GitHub