feat: finalize pnpm migration (#727)

* feat: complete pnpm migration and fix lingering references

* chore: address Copilot review feedback

* chore: replace remaining npx calls with pnpm exec

* fix: resolve CI version mismatch and finalize pnpm standardization

* fix(ci): add vite to devDependencies for vitest

* chore: update pnpm-lock.yaml after adding vite

Author: timothyfroehlich

.claude/agents/enforcer.md

@@ -86,14 +86,14 @@ color: red
 ### Migration File Creation
 
 - **Pre-Beta Constraint**: NO migration files in `supabase/migrations/`
-- **Forbidden Commands**: `drizzle-kit generate`, `npm run db:generate`
+- **Forbidden Commands**: `drizzle-kit generate`, `pnpm run db:generate`
 - **Context**: Zero users, schema in flux, velocity over safety
 
 ### Vitest Command Issues
 
-- **Redirection Breaks Vitest**: `npm test 2>&1`, `vitest >>`
+- **Redirection Breaks Vitest**: `pnpm test 2>&1`, `vitest >>`
 - **Cause**: Vitest interprets redirection as test name filters
-- **Required**: Use `npm run test:brief`, `npm run test:verbose`
+- **Required**: Use `pnpm run test:brief`, `pnpm run test:verbose`
 
 ### Schema Modification Lock
 

.claude/hooks/quality-check.cjs

@@ -308,7 +308,7 @@ class FileDebouncer {
   shouldCheck(filePath) {
     const now = Date.now();
     const lastCheck = this.recentChecks.get(filePath) || 0;
-    
+
     // If we checked this file recently (within debounce window), skip
     if (now - lastCheck < this.debounceMs) {
       log.debug(`Debouncing check for ${path.basename(filePath)} (last check ${now - lastCheck}ms ago)`);
@@ -371,7 +371,7 @@ class FileDebouncer {
       clearTimeout(timeoutId);
     }
     this.pendingChecks.clear();
-    
+
     // Clear cleanup interval
     if (this.cleanupInterval) {
       clearInterval(this.cleanupInterval);
@@ -541,8 +541,8 @@ function analyzeFileContext(filePath, content) {
   // Check for incomplete import patterns
   const lines = content.split('\n');
   const importLines = lines.filter(line => line.trim().startsWith('import '));
-  const nonImportLines = lines.filter(line => 
-    line.trim() && 
+  const nonImportLines = lines.filter(line =>
+    line.trim() &&
     !line.trim().startsWith('import ') &&
     !line.trim().startsWith('//') &&
     !line.trim().startsWith('/*')
@@ -599,7 +599,7 @@ function analyzeFileContext(filePath, content) {
       }
       return false;
     });
-    
+
     if (hasActualEmptyFunctions) {
       reasons.push('Found functions with empty or TODO-marked bodies');
       shouldSkip = true;
@@ -1100,7 +1100,7 @@ function isSourceFile(filePath) {
  */
 function printSummary(problemCounts, autofixes) {
   const problems = [];
-  
+
   if (problemCounts.typescript > 0) {
     problems.push(`TypeScript: ${problemCounts.typescript} error${problemCounts.typescript > 1 ? 's' : ''}`);
   }
@@ -1113,7 +1113,7 @@ function printSummary(problemCounts, autofixes) {
   if (problemCounts.common > 0) {
     problems.push(`Code issues: ${problemCounts.common} problem${problemCounts.common > 1 ? 's' : ''}`);
   }
-  
+
   if (problems.length > 0) {
     console.error(problems.join(', '));
   }
@@ -1175,25 +1175,25 @@ async function main() {
   if (totalProblems > 0) {
     printSummary(problemCounts, autofixes);
     console.error(`${colors.yellow}💡 Remember to resolve the issues before moving on to another file${colors.reset}`);
-    
+
     // Generate specific commands for this file
     const relativePath = path.relative(projectRoot, filePath);
     const commands = [];
-    
+
     if (problemCounts.typescript > 0) {
       commands.push(`pnpm run typecheck:brief`);
     }
     if (problemCounts.eslint > 0) {
-      commands.push(`npx eslint "${relativePath}"`);
+      commands.push(`pnpm exec eslint "${relativePath}"`);
     }
     if (problemCounts.prettier > 0) {
-      commands.push(`npx prettier --check "${relativePath}"`);
+      commands.push(`pnpm exec prettier --check "${relativePath}"`);
     }
-    
+
     if (commands.length > 0) {
       console.error(`${colors.blue}💡 Run: ${commands.join(' && ')}${colors.reset}`);
     }
-    
+
     console.error(`${colors.yellow}⚠ ${path.basename(filePath)} - has issues to resolve${colors.reset}`);
     process.exit(0); // Advisory only - don't block workflow
   } else {

.claude/settings.json

@@ -12,7 +12,7 @@
       "WebFetch(domain:prettier.io)",
       "WebFetch(domain:docs.npmjs.com)",
       "Bash(pnpm test:*)",
-      "Bash(npx jest:*)",
+      "Bash(pnpm test:*)",
       "Bash(pnpm run typecheck:*)",
       "Bash(pnpm run typecheck:brief:*)",
       "Bash(pnpm run build:*)",
@@ -22,16 +22,16 @@
       "Bash(pnpm run lint:*)",
       "Bash(pnpm run check:brief:*)",
       "Bash(pnpm run smoke:*)",
-      "Bash(npx eslint:*)",
-      "Bash(npx prettier:*)",
-      "Bash(npx next:*)",
+      "Bash(pnpm exec eslint:*)",
+      "Bash(pnpm exec prettier:*)",
+      "Bash(pnpm exec next:*)",
       "Bash(pnpm dlx shadcn:*)",
       "WebFetch(domain:ui.shadcn.com)",
       "Bash(pnpm exec playwright test:*)",
       "Bash(pnpm exec playwright show-trace:*)",
       "Bash(PLAYWRIGHT_PORT=3001 pnpm run smoke)",
       "Bash(./scripts/safe-curl.sh:*)",
-      "Bash(npx tsc:*)",
+      "Bash(pnpm exec tsc:*)",
       "Bash(ls:*)",
       "Bash(grep:*)",
       "Bash(gitleaks detect:*)",

.claude/skills/pinpoint-testing/SKILL.md

@@ -23,12 +23,12 @@ Use this skill when:
 
 ### Commands
 ```bash
-npm run check          # Quick: types + lint + unit (~5s)
-npm test               # Unit tests only
-npm test -- path/to/file.test.ts  # Targeted unit test
-npm run test:integration          # DB integration tests (requires supabase start)
-npm run smoke                     # E2E smoke tests (Playwright)
-npm run preflight                 # Full suite (~60s) - run before commit
+pnpm run check          # Quick: types + lint + unit (~5s)
+pnpm test               # Unit tests only
+pnpm test -- path/to/file.test.ts  # Targeted unit test
+pnpm run test:integration          # DB integration tests (requires supabase start)
+pnpm run smoke                     # E2E smoke tests (Playwright)
+pnpm run preflight                 # Full suite (~60s) - run before commit
 ```
 
 ### Critical Rules
@@ -301,7 +301,7 @@ Before committing tests:
 - [ ] No arbitrary `waitForTimeout()` in E2E tests
 - [ ] Tests are independent (no shared state)
 - [ ] Testing behavior, not implementation
-- [ ] `npm run preflight` passes (includes all test suites)
+- [ ] `pnpm run preflight` passes (includes all test suites)
 
 ## Additional Resources
 

.claude/skills/pinpoint-typescript/SKILL.md

@@ -421,7 +421,7 @@ Before committing TypeScript code:
 - [ ] Optional properties use conditional spread
 - [ ] Type guards for complex narrowing
 - [ ] Path aliases (`~/`) instead of relative imports
-- [ ] `npm run typecheck` passes
+- [ ] `pnpm run typecheck` passes
 
 ## Additional Resources
 

.claude/skills/pinpoint-ui/SKILL.md

@@ -28,7 +28,7 @@ Use this skill when:
 
 ### Adding Components
 ```bash
-npx shadcn@latest add [component]
+pnpm exec shadcn@latest add [component]
 ```
 
 ## Detailed Documentation

.devcontainer/bootstrap.sh

@@ -10,11 +10,11 @@ export PATH="$HOME/.local/bin:$PATH"
 
 # Install Claude Code CLI
 echo "📦 Installing Claude Code CLI..."
-npm install -g @anthropic-ai/claude-code
+pnpm install -g @anthropic-ai/claude-code
 
 # Install project dependencies
 echo "📦 Installing project dependencies..."
-npm install
+pnpm install
 
 # Check if .env.local exists, if not create from example
 if [ ! -f .env.local ]; then
@@ -45,5 +45,5 @@ echo ""
 echo "📝 Next steps:"
 echo "   1. Authenticate Claude Code: claude auth login"
 echo "   2. Update .env.local with your Supabase credentials"
-echo "   3. Run 'npm run dev' to start the development server"
+echo "   3. Run 'pnpm run dev' to start the development server"
 echo ""

.github-staging/workflows/ci.yml

@@ -151,7 +151,7 @@ jobs:
         run: npm ci
 
       - name: Install Playwright browsers
-        run: npx playwright install chromium --with-deps
+        run: pnpm exec playwright install --with-deps chromium
 
       - name: Run smoke tests
         run: npm run smoke

.github/copilot-instructions.md

@@ -95,10 +95,10 @@ Refer to `docs/PATTERNS.md` index for:
 Run (or ensure CI runs) before pushing:
 
 ```bash
-npm run typecheck
-npm run lint
-npm run test
-npm run format
+pnpm run typecheck
+pnpm run lint
+pnpm run test
+pnpm run format
 ```
 
 (Use eventual `preflight` script when added.) Conventional commit messages.

.github/dependabot.yml

@@ -1,7 +1,7 @@
 version: 2
 updates:
-  # npm dependencies with different cooldowns per update type
-  - package-ecosystem: "npm"
+  # pnpm dependencies with different cooldowns per update type
+  - package-ecosystem: "pnpm"
     directory: "/"
     schedule:
       interval: "daily"
@@ -33,7 +33,7 @@ updates:
           - "patch"
     labels:
       - "dependencies"
-      - "npm"
+      - "pnpm"
 
   # GitHub Actions with 2-week cooldown
   - package-ecosystem: "github-actions"