chore: migrate to pnpm (#704)

- Updated package.json to use pnpm and added packageManager field
- Generated pnpm-lock.yaml and removed package-lock.json
- Updated GitHub Actions (CI) to use pnpm for installation and caching
- Updated VS Code settings and tasks to use pnpm
- Updated all scripts in scripts/ to use pnpm
- Updated Dev Container bootstrap script
- Updated documentation (README.md, AGENTS.md, docs/*) to reference pnpm commands
- Updated Claude agent configuration and hooks to use pnpm

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: Tim Froehlich <timothyfroehlich@gmail.com>

Author: google-labs-jules[bot]

.claude/agents/enforcer.md

@@ -146,15 +146,15 @@ color: red
   </memory-safety-check>
 
   <migration-prevention>
-    <scan-for patterns="supabase/migrations/|drizzle-kit generate|npm run db:generate">
+    <scan-for patterns="supabase/migrations/|drizzle-kit generate|pnpm run db:generate">
       <severity>CRITICAL</severity>
       <action>BLOCK_PR</action>
       <message>Migration files forbidden in pre-beta phase</message>
     </scan-for>
   </migration-prevention>
 
   <vitest-safety>
-    <scan-for patterns="npm test.*2>&1|vitest.*>>|npm test.*>">
+    <scan-for patterns="pnpm test.*2>&1|vitest.*>>|pnpm test.*>">
       <severity>CRITICAL</severity>
       <action>BLOCK_PR</action>
       <message>Vitest redirection breaks test execution</message>
@@ -239,25 +239,25 @@ color: red
 ```xml
 <quality-gates>
   <compilation>
-    <command>npm run typecheck</command>
+      <command>pnpm run typecheck</command>
     <requirement>MUST pass without errors</requirement>
     <failure-action>BLOCK_PR</failure-action>
   </compilation>
 
   <linting>
-    <command>npm run lint</command>
+      <command>pnpm run lint</command>
     <requirement>MUST pass without violations</requirement>
     <failure-action>BLOCK_PR</failure-action>
   </linting>
 
   <testing>
-    <command>npm run test:brief</command>
+      <command>pnpm run test:brief</command>
     <requirement>All relevant tests pass</requirement>
     <failure-action>INVESTIGATE_FAILURES</failure-action>
   </testing>
 
   <build>
-    <command>npm run build</command>
+      <command>pnpm run build</command>
     <requirement>Successful completion</requirement>
     <failure-action>BLOCK_PR</failure-action>
   </build>

.claude/agents/investigator.md

@@ -51,7 +51,7 @@ color: blue
 
 ### Error Analysis Workflow
 
-1. **Quality Assessment**: Run `npm run typecheck:verbose`, `npm run lint:verbose`, `npm run test`
+1. **Quality Assessment**: Run `pnpm run typecheck:verbose`, `pnpm run lint:verbose`, `pnpm run test`
 2. **Pattern Detection**: Use `rg` searches for systematic issues and anti-patterns
 3. **Context Analysis**: Analyze related files, imports, and dependencies
 4. **Historical Analysis**: Review git history and GitHub issues for correlation
@@ -78,33 +78,33 @@ color: blue
 
 ```bash
 # TypeScript Analysis (Brief & Verbose)
-npm run typecheck
-npm run typecheck:brief
-npm run typecheck:verbose
+pnpm run typecheck
+pnpm run typecheck:brief
+pnpm run typecheck:verbose
 
 # Linting Analysis (Brief & Verbose)
-npm run lint
-npm run lint:brief
-npm run lint:verbose
-npm run lint:eslint:verbose
+pnpm run lint
+pnpm run lint:brief
+pnpm run lint:verbose
+pnpm run lint:eslint:verbose
 
 # Format Checking (Read-Only)
-npm run format
-npm run format:brief
+pnpm run format
+pnpm run format:brief
 
 # Build Analysis
-npm run build
+pnpm run build
 ```
 
 ### Test Analysis
 
 ```bash
 # Test Execution & Analysis
-npm run test
-npm run test:watch
-npm run test:brief
-npm run test:rls
-npm run test:all
+pnpm run test
+pnpm run test:watch
+pnpm run test:brief
+pnpm run test:rls
+pnpm run test:all
 ```
 
 ### Search & Pattern Detection

.claude/commands/z-ship-it.md

@@ -53,7 +53,7 @@ Take boring meta changes and LAUNCH THEM INTO PRODUCTION with the power of autom
 
 6. **Run the quick tests** (because we're not _completely_ reckless):
    ```bash
-   npm run check:brief
+   pnpm run check:brief
    ```
 7. **If tests fail**:
 

.claude/commands/z-smart-rebase.md

@@ -48,7 +48,7 @@ Perform an intelligent rebase operation with the following workflow:
 
 6. **Validate the result**:
    - Ensure all conflicts are resolved
-   - Run `npm run quick` to verify code quality
+   - Run `pnpm run quick` to verify code quality
    - If validation fails, provide clear next steps
 
 7. **Complete the operation**:
@@ -94,7 +94,7 @@ Perform an intelligent rebase operation with the following workflow:
 
 - ✅ Branch is up-to-date with target (main or parent)
 - ✅ All merge conflicts resolved
-- ✅ Code quality checks pass (`npm run quick`)
+- ✅ Code quality checks pass (`pnpm run quick`)
 - ✅ User understands what changes were made
 - ✅ Clear next steps provided
 

.claude/hooks/pattern-reminder.cjs

@@ -42,7 +42,7 @@ const FORBIDDEN_PATTERNS = {
     patterns: [
       /supabase\/migrations\//g,
       /drizzle-kit generate/g,
-      /npm run db:generate/g
+      /pnpm run db:generate/g
     ],
     severity: 'CRITICAL', 
     message: 'Migration files forbidden in pre-beta phase (zero users, schema in flux)',
@@ -52,13 +52,13 @@ const FORBIDDEN_PATTERNS = {
   // Vitest Command Issues (HIGH)
   'Vitest Redirection': {
     patterns: [
-      /npm test.*2>&1/g,
+      /pnpm test.*2>&1/g,
       /vitest.*>>/g,
-      /npm test.*>/g
+      /pnpm test.*>/g
     ],
     severity: 'HIGH',
     message: 'Vitest interprets redirection as test name filters, breaking execution', 
-    solution: 'Use npm run test:brief or npm run test:verbose instead'
+    solution: 'Use pnpm run test:brief or pnpm run test:verbose instead'
   },
 
   // Database Naming Conventions (HIGH)

.claude/hooks/quality-check.cjs

@@ -1181,7 +1181,7 @@ async function main() {
     const commands = [];
 
     if (problemCounts.typescript > 0) {
-      commands.push(`npm run typecheck:brief`);
+      commands.push(`pnpm run typecheck:brief`);
     }
     if (problemCounts.eslint > 0) {
       commands.push(`npx eslint "${relativePath}"`);

.claude/settings.json

@@ -11,25 +11,25 @@
       "WebFetch(domain:eslint.org)",
       "WebFetch(domain:prettier.io)",
       "WebFetch(domain:docs.npmjs.com)",
-      "Bash(npm test:*)",
+      "Bash(pnpm test:*)",
       "Bash(npx jest:*)",
-      "Bash(npm run typecheck:*)",
-      "Bash(npm run typecheck:brief:*)",
-      "Bash(npm run build:*)",
-      "Bash(timeout 10 npm run build:*)",
-      "Bash(timeout 30 npm run build:*)",
-      "Bash(timeout 10s npm run dev)",
-      "Bash(npm run lint:*)",
-      "Bash(npm run check:brief:*)",
-      "Bash(npm run smoke:*)",
+      "Bash(pnpm run typecheck:*)",
+      "Bash(pnpm run typecheck:brief:*)",
+      "Bash(pnpm run build:*)",
+      "Bash(timeout 10 pnpm run build:*)",
+      "Bash(timeout 30 pnpm run build:*)",
+      "Bash(timeout 10s pnpm run dev)",
+      "Bash(pnpm run lint:*)",
+      "Bash(pnpm run check:brief:*)",
+      "Bash(pnpm run smoke:*)",
       "Bash(npx eslint:*)",
       "Bash(npx prettier:*)",
       "Bash(npx next:*)",
-      "Bash(npx shadcn:*)",
+      "Bash(pnpm dlx shadcn:*)",
       "WebFetch(domain:ui.shadcn.com)",
-      "Bash(npx playwright test:*)",
-      "Bash(npx playwright show-trace:*)",
-      "Bash(PLAYWRIGHT_PORT=3001 npm run smoke)",
+      "Bash(pnpm exec playwright test:*)",
+      "Bash(pnpm exec playwright show-trace:*)",
+      "Bash(PLAYWRIGHT_PORT=3001 pnpm run smoke)",
       "Bash(./scripts/safe-curl.sh:*)",
       "Bash(npx tsc:*)",
       "Bash(ls:*)",
@@ -54,7 +54,7 @@
       "Bash(./scripts/check-security-deps.sh:*)",
       "Bash(./scripts/check-file-security.sh:*)",
       "Bash(./scripts/check-db-schema.sh:*)",
-      "Bash(./scripts/check-npm-audit.sh:*)",
+      "Bash(./scripts/check-pnpm-audit.sh:*)",
       "Bash(./scripts/safe-psql.sh:*)",
       "WebFetch(domain:docs.anthropic.com)",
       "WebFetch(domain:github.com)",

AGENTS.md

@@ -16,38 +16,38 @@ trigger: always_on
 **Run BEFORE every commit:**
 
 ```bash
-npm run preflight  # Typecheck, lint, format, test, build, integration tests
+pnpm run preflight  # Typecheck, lint, format, test, build, integration tests
 ```
 
 **Development:**
 
 ```bash
-npm run dev              # Start dev server (uses PORT from .env.local)
-npm run build            # Production build
-npm run typecheck        # TypeScript validation
-npm run lint             # ESLint check
-npm test                 # Unit tests only
-npm run test:integration # DB integration tests (requires `supabase start`)
-npm run smoke            # E2E smoke tests (Playwright)
+pnpm run dev              # Start dev server (uses PORT from .env.local)
+pnpm run build            # Production build
+pnpm run typecheck        # TypeScript validation
+pnpm run lint             # ESLint check
+pnpm test                 # Unit tests only
+pnpm run test:integration # DB integration tests (requires `supabase start`)
+pnpm run smoke            # E2E smoke tests (Playwright)
 ```
 
 **Database Migrations (ALWAYS use migrations, never `push`):**
 
 ```bash
 # 1. Edit src/server/db/schema.ts
 # 2. Generate migration:
-npm run db:generate -- --name <descriptive-name>
+pnpm run db:generate -- --name <descriptive-name>
 # 3. Apply migration:
-npm run db:migrate
+pnpm run db:migrate
 # 4. Update test schema:
-npm run test:_generate-schema
+pnpm run test:_generate-schema
 # 5. Commit schema.ts, drizzle/, and src/test/setup/schema.sql
 ```
 
 **Components:**
 
 ```bash
-npx shadcn@latest add [component]  # Add shadcn/ui components
+pnpm dlx shadcn@latest add [component]  # Add shadcn/ui components
 ```
 
 ## Tech Stack
@@ -72,7 +72,7 @@ npx shadcn@latest add [component]  # Add shadcn/ui components
 7. **CSP with nonces**: Security headers required. Use `middleware.ts` for dynamic nonces, `next.config.ts` for static headers.
 8. **Type safety (strictest)**: No `any`, no `!`, no unsafe `as`. Write type guards for validation.
 9. **Path aliases (`~/`)**: Always use `~/lib/...` instead of relative imports `../../../lib/...`.
-10. **Preflight before commit**: `npm run preflight` must pass. Pre-commit hooks enforce this.
+10. **Preflight before commit**: `pnpm run preflight` must pass. Pre-commit hooks enforce this.
 
 ## Quick Code Examples
 
@@ -267,12 +267,12 @@ For detailed guidance, use Agent Skills (if supported) or reference docs directl
 
 **Dev Loop**:
 
-| Command                            | When to use                      |
-| ---------------------------------- | -------------------------------- |
-| `npm run check`                    | After ANY code change (~5s)      |
-| `npm test -- path/to/file.test.ts` | Debug specific test              |
-| `npm run preflight`                | Before commit (full suite, ~60s) |
-| **Mobile Safari**                  | **DO NOT RUN LOCALLY** (CI only) |
+| Command                             | When to use                      |
+| ----------------------------------- | -------------------------------- |
+| `pnpm run check`                    | After ANY code change (~5s)      |
+| `pnpm test -- path/to/file.test.ts` | Debug specific test              |
+| `pnpm run preflight`                | Before commit (full suite, ~60s) |
+| **Mobile Safari**                   | **DO NOT RUN LOCALLY** (CI only) |
 
 **Key Constraints**:
 
@@ -312,7 +312,7 @@ For detailed guidance, use Agent Skills (if supported) or reference docs directl
 ## Commit Guidelines
 
 - **Style**: Conventional commits (`feat:`, `fix:`, `chore:`)
-- **Process**: Run `npm run preflight` → commit → push
+- **Process**: Run `pnpm run preflight` → commit → push
 - **Hooks**: Husky + lint-staged enforce quality gates
 
 ## GitHub Copilot Reviews

docs/CI_WORKFLOW_SETUP.md

@@ -8,18 +8,18 @@ The actual configuration lives in `.github/workflows/ci.yml` and is committed to
 On pushes and pull requests to `main`:
 
 - **Install & Cache Dependencies**
-  - Runs `npm ci`
-  - Caches `node_modules` and Playwright browsers for faster subsequent runs
+  - Runs `pnpm install`
+  - Caches `pnpm` store and Playwright browsers for faster subsequent runs
 - **Quality Checks (Parallel)**
-  - `npm run typecheck`
-  - `npm run lint`
-  - `npm run format`
+  - `pnpm run typecheck`
+  - `pnpm run lint`
+  - `pnpm run format`
 - **Build**
-  - `npm run build` (runs after quality checks pass)
+  - `pnpm run build` (runs after quality checks pass)
 - **Tests**
-  - Unit tests: `npm test`
-  - Integration tests: `npm run test:integration`
-  - Smoke E2E tests: `npm run smoke` (after a successful build)
+  - Unit tests: `pnpm test`
+  - Integration tests: `pnpm run test:integration`
+  - Smoke E2E tests: `pnpm run smoke` (after a successful build)
 - **Artifacts**
   - Uploads Playwright reports on E2E failures to aid debugging
 
@@ -28,7 +28,7 @@ On pushes and pull requests to `main`:
 Before pushing, run:
 
 ```bash
-npm run preflight
+pnpm run preflight
 ```
 
 This mirrors the CI pipeline locally (typecheck, lint, format, tests, build, integration tests, smoke tests).

docs/DISCIPLINE.md

@@ -240,13 +240,13 @@ Session 4: Issue filtering (DB + Action + UI) - WORKS
 
 ```bash
 # 1. Write test for current behavior
-npm test -- issue-creation
+pnpm test -- issue-creation
 
 # 2. Refactor
 # ... make changes ...
 
 # 3. Verify test still passes
-npm test -- issue-creation
+pnpm test -- issue-creation
 
 # 4. Ship if it works
 git commit -m "refactor: simplify issue creation"