CAP-4840-switch-from-npm-to-pnpm

.github/workflows/ci.yml

@@ -16,11 +16,12 @@ jobs:
         node: [22, 24]
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
-          cache: npm
-      - run: npm ci
-      - run: npm run typecheck
-      - run: npm test
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm test
       - run: node dist/cli.js --version

.github/workflows/release.yml

@@ -16,13 +16,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
+          # No dependency cache in the job that can publish (cache-poisoning hardening).
       # Trusted publishing needs npm 11.5.1 or newer.
       - run: npm install -g npm@latest
-      - run: npm ci
+      - run: pnpm install --frozen-lockfile
       - name: Tag matches package.json version
         run: test "v$(node -p 'require(`./package.json`).version')" = "$GITHUB_REF_NAME"
+      # npm, not pnpm, publishes: npm does the trusted-publishing (OIDC) exchange.
+      # prepublishOnly still runs typecheck and tests through pnpm.
       - run: npm publish

AGENTS.md

@@ -9,4 +9,4 @@
 - Every command goes through `action()` in `src/command.ts`.
 - Changing a command means updating `skills/perspective/SKILL.md`, `README.md`, and the
   developer docs (`developer-docs/docs/cli/`).
-- Verify with `npm run typecheck`, `npm test` and `npm run build`.
+- Use pnpm, not npm. Verify with `pnpm typecheck`, `pnpm test` and `pnpm build`.

README.md

@@ -12,7 +12,7 @@ Full docs: <https://developers.perspective.co/cli/overview>
 Requires Node.js ≥ 22.12.
 
 ```bash
-npm install -g @perspective-software/cli
+npm install -g @perspective-software/cli    # or: pnpm add -g @perspective-software/cli
 perspective --help
 ```
 
@@ -76,10 +76,10 @@ perspective skill show               # print it (JSON; | jq -r .content)
 ## Development
 
 ```bash
-npm install          # also builds dist/ via `prepare`
-npm test
-npm run typecheck
-npm run dev -- funnels list          # run from source (Node's type stripping)
+pnpm install                         # also builds dist/ via `prepare`
+pnpm test
+pnpm typecheck
+pnpm dev funnels list                # run from source (Node's type stripping)
 perspective --base-url http://localhost:3000 …   # point at a local External API
 ```