current implementation requires a fully setup env.

yarn runs under the hood an install, if the setup is not complete. This is a yarn-internal process.

what about analysis of a not-installed setup in a no-network environment?

lets have a CLI switch --package-lock-only, that causes no interaction with the cache/fs