One of the goals of the dependency scanner is to generate command-lines that can be used to explicitly build modular dependencies of a translation unit. The only modifications to these command-lines should be for the purposes of explicit modular build.
However, the current version of dependency scanner leaks its implementation details into the command-lines.
The first problem is that the clang-scan-deps tool adjusts the original textual command-line (adding -Eonly -M -MT <target> -sys-header-deps -Wno-error -o /dev/null , removing --serialize-diagnostics) in order to set up the DependencyScanning library. This has been addressed in D103461, D104012, D104030, D104031, D104033. With these patches, the DependencyScanning library receives the unmodified CompilerInvocation, sets it up and uses it for the implicit modular build.
Finally, to prevent leaking the implementation details to the resulting command-lines, this patch generates them from the original unmodified CompilerInvocation rather than from the one that drives the implicit build.
I wonder if it'd be better to take CompilerInvocation&& here. Then the caller is required to either pass std::move or make a deep copy at the call site, and it's perhaps more clear that there's a deep copy being made.