diff --git a/lib/audit.js b/lib/audit.js
index f990e1fa5efaa..9df2698589278 100644
--- a/lib/audit.js
+++ b/lib/audit.js
@@ -18,6 +18,7 @@ class Audit extends BaseCommand {
   /* istanbul ignore next - see test/lib/load-all-commands.js */
   static get params () {
     return [
+      'audit-level',
       'dry-run',
       'force',
       'json',
diff --git a/lib/ci.js b/lib/ci.js
index b73b3a8591114..9ae31950ef102 100644
--- a/lib/ci.js
+++ b/lib/ci.js
@@ -42,8 +42,14 @@ class CI extends BaseCommand {
     }
 
     const where = this.npm.prefix
-    const arb = new Arborist({ ...this.npm.flatOptions, path: where })
+    const opts = {
+      ...this.npm.flatOptions,
+      path: where,
+      log: this.npm.log,
+      save: false, // npm ci should never modify the lockfile or package.json
+    }
 
+    const arb = new Arborist(opts)
     await Promise.all([
       arb.loadVirtual().catch(er => {
         log.verbose('loadVirtual', er.stack)
@@ -55,8 +61,7 @@ class CI extends BaseCommand {
       }),
       removeNodeModules(where),
     ])
-    // npm ci should never modify the lockfile or package.json
-    await arb.reify({ ...this.npm.flatOptions, save: false })
+    await arb.reify(opts)
 
     const ignoreScripts = this.npm.config.get('ignore-scripts')
     // run the same set of scripts that `npm install` runs.
diff --git a/lib/config.js b/lib/config.js
index d5ef6ec50a5e6..6bfde9845ce33 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -88,6 +88,10 @@ class Config extends BaseCommand {
     this.config(args).then(() => cb()).catch(cb)
   }
 
+  execWorkspaces (args, filters, cb) {
+    this.exec(args, cb)
+  }
+
   async config ([action, ...args]) {
     this.npm.log.disableProgress()
     try {
diff --git a/lib/dedupe.js b/lib/dedupe.js
index b80a777fcc2f7..9649025739c60 100644
--- a/lib/dedupe.js
+++ b/lib/dedupe.js
@@ -30,6 +30,7 @@ class Dedupe extends BaseCommand {
     const where = this.npm.prefix
     const opts = {
       ...this.npm.flatOptions,
+      log: this.npm.log,
       path: where,
       dryRun,
     }
diff --git a/lib/exec.js b/lib/exec.js
index 0a61de7c1200c..5967ee4234592 100644
--- a/lib/exec.js
+++ b/lib/exec.js
@@ -175,7 +175,11 @@ class Exec extends BaseCommand {
     if (needInstall) {
       const installDir = this.cacheInstallDir(packages)
       await mkdirp(installDir)
-      const arb = new Arborist({ ...this.npm.flatOptions, path: installDir })
+      const arb = new Arborist({
+        ...this.npm.flatOptions,
+        log: this.npm.log,
+        path: installDir,
+      })
       const tree = await arb.loadActual()
 
       // at this point, we have to ensure that we get the exact same
@@ -212,7 +216,11 @@ class Exec extends BaseCommand {
               throw new Error('canceled')
           }
         }
-        await arb.reify({ ...this.npm.flatOptions, add })
+        await arb.reify({
+          ...this.npm.flatOptions,
+          log: this.npm.log,
+          add,
+        })
       }
       pathArr.unshift(resolve(installDir, 'node_modules/.bin'))
     }
diff --git a/lib/install.js b/lib/install.js
index 54ea6d8251051..a023015ed823a 100644
--- a/lib/install.js
+++ b/lib/install.js
@@ -126,15 +126,16 @@ class Install extends BaseCommand {
     if (this.npm.config.get('dev'))
       log.warn('install', 'Usage of the `--dev` option is deprecated. Use `--include=dev` instead.')
 
-    const arb = new Arborist({
+    const opts = {
       ...this.npm.flatOptions,
+      log: this.npm.log,
+      auditLevel: null,
       path: where,
-    })
-
-    await arb.reify({
-      ...this.npm.flatOptions,
       add: args,
-    })
+    }
+    const arb = new Arborist(opts)
+    await arb.reify(opts)
+
     if (!args.length && !isGlobalInstall && !ignoreScripts) {
       const scriptShell = this.npm.config.get('script-shell') || undefined
       const scripts = [
diff --git a/lib/link.js b/lib/link.js
index fe9cfd3a6b254..3e9ec1807fca1 100644
--- a/lib/link.js
+++ b/lib/link.js
@@ -66,6 +66,7 @@ class Link extends BaseCommand {
     const globalOpts = {
       ...this.npm.flatOptions,
       path: globalTop,
+      log: this.npm.log,
       global: true,
       prune: false,
     }
@@ -113,12 +114,14 @@ class Link extends BaseCommand {
     // reify all the pending names as symlinks there
     const localArb = new Arborist({
       ...this.npm.flatOptions,
+      log: this.npm.log,
       path: this.npm.prefix,
       save,
     })
     await localArb.reify({
       ...this.npm.flatOptions,
       path: this.npm.prefix,
+      log: this.npm.log,
       add: names.map(l => `file:${resolve(globalTop, 'node_modules', l)}`),
       save,
     })
@@ -131,9 +134,13 @@ class Link extends BaseCommand {
     const arb = new Arborist({
       ...this.npm.flatOptions,
       path: globalTop,
+      log: this.npm.log,
       global: true,
     })
-    await arb.reify({ add: [`file:${this.npm.prefix}`] })
+    await arb.reify({
+      add: [`file:${this.npm.prefix}`],
+      log: this.npm.log,
+    })
     await reifyFinish(this.npm, arb)
   }
 
diff --git a/lib/prune.js b/lib/prune.js
index 1da86a3e82187..5c4a549d4d7ad 100644
--- a/lib/prune.js
+++ b/lib/prune.js
@@ -30,11 +30,13 @@ class Prune extends BaseCommand {
 
   async prune () {
     const where = this.npm.prefix
-    const arb = new Arborist({
+    const opts = {
       ...this.npm.flatOptions,
       path: where,
-    })
-    await arb.prune(this.npm.flatOptions)
+      log: this.npm.log,
+    }
+    const arb = new Arborist(opts)
+    await arb.prune(opts)
     await reifyFinish(this.npm, arb)
   }
 }
diff --git a/lib/set-script.js b/lib/set-script.js
index df101a0acb709..9d4aadad558fb 100644
--- a/lib/set-script.js
+++ b/lib/set-script.js
@@ -2,6 +2,7 @@ const log = require('npmlog')
 const fs = require('fs')
 const parseJSON = require('json-parse-even-better-errors')
 const rpj = require('read-package-json-fast')
+const { resolve } = require('path')
 
 const BaseCommand = require('./base-command.js')
 class SetScript extends BaseCommand {
@@ -20,6 +21,16 @@ class SetScript extends BaseCommand {
     return ['[<script>] [<command>]']
   }
 
+  async completion (opts) {
+    const argv = opts.conf.argv.remain
+    if (argv.length === 2) {
+      // find the script name
+      const json = resolve(this.npm.localPrefix, 'package.json')
+      const { scripts = {} } = await rpj(json).catch(er => ({}))
+      return Object.keys(scripts)
+    }
+  }
+
   exec (args, cb) {
     this.set(args).then(() => cb()).catch(cb)
   }
diff --git a/lib/uninstall.js b/lib/uninstall.js
index dfdd8ebd5a1db..79a4420d89f39 100644
--- a/lib/uninstall.js
+++ b/lib/uninstall.js
@@ -61,12 +61,15 @@ class Uninstall extends BaseCommand {
       }
     }
 
-    const arb = new Arborist({ ...this.npm.flatOptions, path })
-
-    await arb.reify({
+    const opts = {
       ...this.npm.flatOptions,
+      path,
+      log: this.npm.log,
       rm: args,
-    })
+
+    }
+    const arb = new Arborist(opts)
+    await arb.reify(opts)
     await reifyFinish(this.npm, arb)
   }
 }
diff --git a/lib/update.js b/lib/update.js
index 6a87dd9ecddcf..f8cb12d267d8a 100644
--- a/lib/update.js
+++ b/lib/update.js
@@ -51,6 +51,7 @@ class Update extends BaseCommand {
 
     const arb = new Arborist({
       ...this.npm.flatOptions,
+      log: this.npm.log,
       path: where,
     })
 
diff --git a/lib/utils/config/definitions.js b/lib/utils/config/definitions.js
index b8e021c5212bf..3b6d61583e252 100644
--- a/lib/utils/config/definitions.js
+++ b/lib/utils/config/definitions.js
@@ -143,6 +143,7 @@ define('_auth', {
     is safer to use a registry-provided authentication bearer token stored in
     the ~/.npmrc file by running \`npm login\`.
   `,
+  flatten,
 })
 
 define('access', {
@@ -220,7 +221,7 @@ define('audit', {
 
 define('audit-level', {
   default: null,
-  type: ['low', 'moderate', 'high', 'critical', 'none', null],
+  type: ['info', 'low', 'moderate', 'high', 'critical', 'none', null],
   description: `
     The minimum level of vulnerability for \`npm audit\` to exit with
     a non-zero exit code.
diff --git a/tap-snapshots/test-lib-utils-config-describe-all.js-TAP.test.js b/tap-snapshots/test-lib-utils-config-describe-all.js-TAP.test.js
index 8af8c1edd3e52..cfb34dfadb697 100644
--- a/tap-snapshots/test-lib-utils-config-describe-all.js-TAP.test.js
+++ b/tap-snapshots/test-lib-utils-config-describe-all.js-TAP.test.js
@@ -64,7 +64,7 @@ registry and all registries configured for scopes. See the documentation for
 #### \`audit-level\`
 
 * Default: null
-* Type: "low", "moderate", "high", "critical", "none", or null
+* Type: "info", "low", "moderate", "high", "critical", "none", or null
 
 The minimum level of vulnerability for \`npm audit\` to exit with a non-zero
 exit code.
diff --git a/tap-snapshots/test-lib-utils-npm-usage.js-TAP.test.js b/tap-snapshots/test-lib-utils-npm-usage.js-TAP.test.js
index 260e2ab8f8d50..5a860bd2ee554 100644
--- a/tap-snapshots/test-lib-utils-npm-usage.js-TAP.test.js
+++ b/tap-snapshots/test-lib-utils-npm-usage.js-TAP.test.js
@@ -204,7 +204,7 @@ All commands:
                     npm audit [fix]
                     
                     Options:
-                    [--dry-run] [-f|--force] [--json] [--package-lock-only] [--production]
+                    [--audit-level <info|low|moderate|high|critical|none>] [--dry-run] [-f|--force] [--json] [--package-lock-only] [--production]
                     
                     Run "npm help audit" for more info
 
diff --git a/test/lib/config.js b/test/lib/config.js
index 14cd816171da5..98ece0f4f05c7 100644
--- a/test/lib/config.js
+++ b/test/lib/config.js
@@ -93,6 +93,13 @@ t.test('config no args', t => {
   })
 })
 
+t.test('config ignores workspaces', t => {
+  config.execWorkspaces([], [], (err) => {
+    t.match(err, /usage instructions/, 'should not error out when workspaces are defined')
+    t.end()
+  })
+})
+
 t.test('config list', t => {
   t.plan(2)
 
diff --git a/test/lib/install.js b/test/lib/install.js
index b44452a69cc6f..619f0bb346984 100644
--- a/test/lib/install.js
+++ b/test/lib/install.js
@@ -32,7 +32,7 @@ test('should install using Arborist', (t) => {
 
   const npm = mockNpm({
     config: { dev: true },
-    flatOptions: { global: false },
+    flatOptions: { global: false, auditLevel: 'low' },
     globalDir: 'path/to/node_modules/',
     prefix: 'foo',
   })
@@ -42,7 +42,9 @@ test('should install using Arborist', (t) => {
     install.exec(['fizzbuzz'], er => {
       if (er)
         throw er
-      t.match(ARB_ARGS, { global: false, path: 'foo' })
+      t.match(ARB_ARGS,
+        { global: false, path: 'foo', auditLevel: null },
+        'Arborist gets correct args and ignores auditLevel')
       t.equal(REIFY_CALLED, true, 'called reify')
       t.strictSame(SCRIPTS, [], 'no scripts when adding dep')
       t.end()
diff --git a/test/lib/set-script.js b/test/lib/set-script.js
index b6b6e2519f5ba..dc00fd374cc15 100644
--- a/test/lib/set-script.js
+++ b/test/lib/set-script.js
@@ -2,6 +2,43 @@ const test = require('tap')
 const requireInject = require('require-inject')
 const parseJSON = require('json-parse-even-better-errors')
 
+test.test('completion', t => {
+  const SetScript = requireInject('../../lib/set-script.js')
+  const emptyDir = t.testdir()
+  t.test('already have a script name', async t => {
+    const setScript = new SetScript({localPrefix: emptyDir})
+    const res = await setScript.completion({conf: {argv: {remain: ['npm', 'run', 'x']}}})
+    t.equal(res, undefined)
+    t.end()
+  })
+  t.test('no package.json', async t => {
+    const setScript = new SetScript({localPrefix: emptyDir})
+    const res = await setScript.completion({conf: {argv: {remain: ['npm', 'run']}}})
+    t.strictSame(res, [])
+    t.end()
+  })
+  t.test('has package.json, no scripts', async t => {
+    const localPrefix = t.testdir({
+      'package.json': JSON.stringify({}),
+    })
+    const setScript = new SetScript({localPrefix})
+    const res = await setScript.completion({conf: {argv: {remain: ['npm', 'run']}}})
+    t.strictSame(res, [])
+    t.end()
+  })
+  t.test('has package.json, with scripts', async t => {
+    const localPrefix = t.testdir({
+      'package.json': JSON.stringify({
+        scripts: { hello: 'echo hello', world: 'echo world' },
+      }),
+    })
+    const setScript = new SetScript({localPrefix})
+    const res = await setScript.completion({conf: {argv: {remain: ['npm', 'run']}}})
+    t.strictSame(res, ['hello', 'world'])
+    t.end()
+  })
+  t.end()
+})
 test.test('fails on invalid arguments', (t) => {
   const SetScript = requireInject('../../lib/set-script.js', {
     npmlog: {},
diff --git a/test/lib/update.js b/test/lib/update.js
index 695218a7f69cd..780484afbeb03 100644
--- a/test/lib/update.js
+++ b/test/lib/update.js
@@ -10,6 +10,7 @@ const config = {
 const noop = () => null
 const npm = mockNpm({
   globalDir: '',
+  log: noop,
   config,
   prefix: '',
 })
@@ -38,7 +39,7 @@ t.test('no args', t => {
     constructor (args) {
       t.deepEqual(
         args,
-        { ...npm.flatOptions, path: npm.prefix },
+        { ...npm.flatOptions, path: npm.prefix, log: noop },
         'should call arborist contructor with expected args'
       )
     }
@@ -72,7 +73,7 @@ t.test('with args', t => {
     constructor (args) {
       t.deepEqual(
         args,
-        { ...npm.flatOptions, path: npm.prefix },
+        { ...npm.flatOptions, path: npm.prefix, log: noop },
         'should call arborist contructor with expected args'
       )
     }
@@ -140,7 +141,7 @@ t.test('update --global', t => {
       const { path, ...opts } = args
       t.deepEqual(
         opts,
-        npm.flatOptions,
+        { ...npm.flatOptions, log: noop },
         'should call arborist contructor with expected options'
       )