fix: remove --prefer-offline flag to prevent stale cache errors

[Drickon]

What

Removes the --prefer-offline flag from npm install commands in the module installer.

Why

The --prefer-offline flag causes npm to use cached package metadata, which can be stale and fail to resolve recently published package versions (e.g., diff@8.0.3). This results in ETARGET errors during fresh installations.

Fixes #1438

How

• Removed --prefer-offline from both npm install calls in manager.js
• Updated deprecated --production flag to --omit=dev

Testing

Verified that npm install --omit=dev --no-audit --no-fund --no-progress correctly installs dependencies without the stale cache issue.

[coderabbitai]

📝 Walkthrough

Walkthrough

The npm install flags in the external module dependency installation are updated from --production to --omit=dev and --prefer-offline is removed across two code paths. This aligns with npm's deprecation of the --production flag and addresses an issue with offline-cached package metadata causing installation failures.

Changes

Cohort / File(s)	Summary
Module Dependency Installation Flags tools/cli/installers/lib/modules/manager.js	Replaced npm install flags from --production --prefer-offline to --omit=dev in two dependency installation paths (lines 419 and 444)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: removing the --prefer-offline flag from npm install commands to fix stale cache errors.
Description check	✅ Passed	The description clearly explains what was changed, why (stale cache issues with --prefer-offline), how it was fixed, and references the linked issue #1438.
Linked Issues check	✅ Passed	The PR directly addresses the root cause in #1438 by removing --prefer-offline and updating --production to --omit=dev, matching the proposed fix in the issue.
Out of Scope Changes check	✅ Passed	All changes are scoped to fixing the issue: only --prefer-offline and --production flags in npm install commands were modified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[bmadcode]

just saw this - @Drickon can you update re the conflicts?

[bmadcode]

no response re conflicts - reopen if resolved @Drickon

[Drickon]

Resolved the merge conflicts by rebasing onto current main. The fix now correctly preserves --legacy-peer-deps (from #1476) while still removing --prefer-offline and replacing deprecated --production with --omit=dev.

Note: This fix is still needed — the --prefer-offline flag and deprecated --production flag are still present on main. Issue #1479 mentions consolidating installer fixes, but the actual npm flag changes haven't been applied yet.

[Drickon]

Conflicts resolved and rebased onto current main. Since the force-push prevented reopening this PR, created a new one: #1531