[BUG] installing in a scoped workspace with `--omit=dev` still installs devDependencies if they are workspace packages

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Say i have a workspace with two packages:

packages/
  -- dev-dep/package.json
  -- some-app/package.json
package.json

And let's say that some-app lists dev-dep as a dev dependency.

Then, when trying to install prod deps just for the some-app workspace, npm will also install dev-dep.
So running npm ci -w some-app --omit=dev will also install dev-dep.
Which it shouldn't ❌ .

Also, If you remove dev-dep from some-apps's dev dependencies it won't get installed. which is expected behavior ✅ .

Regular dev dependencies (packages not in the workspace like lodash) seem to also work as expected ( not installed when --omit=dev is present)

Expected Behavior

When running install or ci (clean install) scoped to a workspace and using --omit=dev - dev dependencies should not be installed. Even ones which are in the local workspace .

Steps To Reproduce

Node: v20.5.0
NPM: v9.8.0

Reproduce bug

1. download and unzip this: with-dev-dep.tgz
2. run npm run test (don't install before running the test, the script will run the install)

Notice how lodash doesn't get installed but dev-dep does.

More info

Also, here's another example which works as expected.
I removed dev-dep from the dev dependency on some app notice that now it installs correctly

1. download and unzip this: no-dev-dep.tgz
2. run npm run test (don't install before running the test, the script will run the install)

Notice how both lodash and dev-dep don't get installed.

Environment

• npm: v9.8.0
• Node.js: v20.5.0
• OS Name: MacOS Ventura 13.0
• System Model Name: 14" Macbook pro M2 Pro + 32GB
• npm config:

; "user" config from /Users/itamar.gronich/.npmrc

//registry.npmjs.org/:_auth = (protected)
//registry.npmjs.org/:_authToken = (protected)
always-auth = true
email = (my personal email)
registry = "https://registry.npmjs.org/"

; node bin location = /Users/itamar.gronich/.nvm/versions/node/v20.5.0/bin/node
; node version = v20.5.0
; npm local prefix = /Users/itamar.gronich/Dev/test-npm-workspaces
; npm version = 9.8.0
; cwd = /Users/itamar.gronich/Dev/test-npm-workspaces
; HOME = /Users/itamar.gronich
; Run `npm config ls -l` to show all defaults.

Extract the linked with-dev-dep.tgz archive and run npm run test without installing first to reproduce the workspace-scoped npm ci behavior. Trace npm CLI's workspace install handling and add a regression test covering --omit=dev; done means dev-dep is absent while the existing lodash behavior remains correct.