From the skill’s files
Taken from the skill’s own files (its description, section headings and stated usage). Not an AutoGineer summary, and not written by the author as one.
Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, or managing dependencies with catalogs, patches, overrides, config dependencies, or the global virtual store. pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, and enforces strict dependency resolution by default, preventing phantom dependencies.
What it does
- Core
- Features
- Best Practices
When to use it
- Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, or managing dependencies with catalogs, patches, overrides, config dependencies, or the global virtual store.
Advantages
The skill’s files do not state this.
Usage examples
The skill’s files do not state this.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/antfu/pnpm/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip pnpm.zip -d .agents/skills
Documentation by Anthony Fu
pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, and enforces strict dependency resolution by default, preventing phantom dependencies.
pnpm v12 is a Rust rewrite of v11: stable, and keeps v11's commands, flags, settings, and lockfile format — so most guidance here applies to both. A handful of v12 behaviors differ (git deps resolve via HTTPS, project-aware global bins, other package managers, packageImportMethod: auto hardlinks first on Linux) — see best-practices-migration.
Configuration model (important): pnpm settings live in pnpm-workspace.yaml (and the global config.yaml) using camelCase keys. .npmrc is used only for authentication/registry credentials, and the pnpm field of package.json is no longer read. When working in a pnpm project, check pnpm-workspace.yaml for settings/workspace structure and .npmrc only for auth. Always use --frozen-lockfile (or pnpm ci) in CI.
The skill is based on pnpm 12.18, generated at 2026-11-05. It covers v11+v12 behavior (config split, config includes, isolated global packages,
allowBuilds,pmOnFail, global virtual store, native release management, workspace task orchestration, and experimental Python/Cargo support) where current docs describe them.
Core
| Topic | Description | Reference |
|---|---|---|
| CLI Commands | install/add/remove/update, run, dlx/pnx, workspace, runtime, publishing (version, view, sbom, stage) | core-cli |
| Configuration | pnpm-workspace.yaml settings (camelCase), global config.yaml, config includes, packageConfigs, auth (.npmrc, auth.ini) | core-config |
| Workspaces | Monorepo support: filtering, workspace protocol, shared lockfile, packageConfigs | core-workspaces |
| Store | Content-addressable store, virtual store, node linker modes (incl. loaded/store loader), frozen/read-only store | core-store |
Features
| Topic | Description | Reference |
|---|---|---|
| Catalogs | Centralized dependency versions; catalogMode, catalog: in overrides | features-catalogs |
| Overrides | Force versions (incl. transitive & peer deps); packageExtensions | features-overrides |
| Patches | Modify third-party packages; patchedDependencies in pnpm-workspace.yaml | features-patches |
| Aliases | Install under custom names (npm:) and registry aliases (namedRegistries) | features-aliases |
| Hooks | .pnpmfile.mjs hooks (readPackage, updateConfig, beforePacking), finders, resolvers/fetchers | features-hooks |
| Peer Dependencies | Auto-install, strict mode, rules, dedupePeers, peers check | features-peer-deps |
| Config Dependencies | Share hooks/settings/catalogs/patches across repos via configDependencies | features-config-dependencies |
| Global Virtual Store & Shims | Shared node_modules, git-worktree multi-agent setups, isolated global packages, project-aware bins, other package managers | features-global-virtual-store |
| Supply-Chain Security | Build approval (allowBuilds), permissions and agent skills, minimumReleaseAge, trustPolicy, lockfile integrity | features-supply-chain-security |
| Task Orchestration | Cross-project task graphs (tasks/dependsOn), concurrency groups, priority, pnpm pipeline | features-task-orchestration |
| Release Management | Native versioning: pnpm change/version -r/lane, lanes, epics, fixed groups | features-versioning |
| Multi-Ecosystem | Python (pypi:) and Cargo (crate:) dependencies alongside npm (experimental) | features-multi-ecosystem |
Best Practices
| Topic | Description | Reference |
|---|---|---|
| CI/CD Setup | GitHub Actions, GitLab, Docker, pnpm ci, store caching, frozen lockfiles | best-practices-ci |
| Migration | npm/Yarn → pnpm, phantom deps, and pnpm v10 → v11 → v12 upgrade notes | best-practices-migration |
| Performance | Install optimizations, allowBuilds, global virtual store, workspace parallelization | best-practices-performance |
Files
- ATTRIBUTION.mdAdded by AutoGineer889 B
- GENERATION.md134 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md5.1 KiB
- references/best-practices-ci.md9.7 KiB
- references/best-practices-migration.md9.9 KiB
- references/best-practices-performance.md6.0 KiB
- references/core-cli.md11.3 KiB
- references/core-config.md12.8 KiB
- references/core-store.md10.7 KiB
- references/core-workspaces.md6.6 KiB
- references/features-aliases.md4.4 KiB
- references/features-catalogs.md5.0 KiB
- references/features-config-dependencies.md4.2 KiB
- references/features-global-virtual-store.md10.0 KiB
- references/features-hooks.md8.9 KiB
- references/features-multi-ecosystem.md6.2 KiB
- references/features-overrides.md5.5 KiB
- references/features-patches.md5.0 KiB
- references/features-peer-deps.md5.9 KiB
- references/features-supply-chain-security.md7.7 KiB
- references/features-task-orchestration.md6.8 KiB
- references/features-versioning.md5.5 KiB
references/features-task-orchestration.md
name: pnpm-task-orchestration description: Declare cross-project task graphs (tasks/dependsOn), concurrency groups, priorities, and run cached CI pipelines
Workspace Task Orchestration
pnpm -r run <script> schedules a graph of workspace tasks. A task is <project>#<script>; it becomes ready once every task it depends on succeeds, and ready tasks run under --workspace-concurrency. Independent tasks run in unpredictable order.
Declaring task dependencies
Configure under tasks in pnpm-workspace.yaml:
tasks:
build:
dependsOn:
- ^build # build in each workspace dependency
test:
dependsOn:
- build # build in the same projectbuild→ thebuildtask in the same project.^build→ thebuildtask in each selected workspace dependency.A task with no
tasksentry defaults to depending on the same task in its workspace deps (an unconfiguredbuildbehaves asdependsOn: ['^build']), preserving deps-before-dependents order.Once a task has an entry, an omitted
dependsOnmeansdependsOn: []. If you set another field (e.g.concurrency) and still want topological order, declaredependsOn: ['^build']explicitly.Task deps stay within the
--filter/includeWorkspaceRootselection. A project missing the named script is a pass-through (reported skipped, doesn't break the chain).
Per-task concurrency
tasks:
build:
concurrency: 2 # max 2 instances of build across projects
dependsOn: ['^build']Separate from --workspace-concurrency; a task waiting for its slot doesn't occupy a workspace slot.
Concurrency groups (v12.5.0)
Machine-wide limits shared across pnpm processes that use the same stateDir (including pnpm pipeline):
tasks:
test:rust:
concurrencyGroup: cargo
dependsOn: []
concurrencyGroups:
cargo: 2 # at most 2 cargo tasks at once, across processesA nested
pnpm runin the same group reuses its parent's slot. Slots release on process exit/crash.A missing/zero group limit doesn't restrict. Changing
stateDircreates a separate slot pool.
Task priority (v12.6.0)
priority (integer, default 0) orders waiting tasks for available slots — higher runs first, ties broken by arrival:
tasks:
build:critical: { concurrencyGroup: build, priority: 10 }
build:cleanup: { concurrencyGroup: build, priority: -1 }Inspecting groups (v12.6.0)
pnpm tasks status [groups...] # running + waiting tasks per group
pnpm pm tasks status # force built-in if a "tasks" script shadows itA subcommand is required. A waiting task shows its priority only when non-zero.
Inspecting the graph
pnpm -r run --dry-run build # stable topological ordering, no scripts run
pnpm -r run --dry-run --json test # nodes + edges as JSONRecursive run options
--resume-from <pkg>— resume at a package's task, skipping tasks a prior run of the same invocation recorded as passed.--reverse— reverse every edge (dependents run first).--no-bail— keep running independent ready tasks after a failure; tasks depending on the failed one are skipped (default--bailstops dispatching and kills running tasks: SIGTERM, then SIGKILL after 2s on Unix). Accepted only by run/exec/test/start/stop/rebuild/install-test.--workspace-concurrencydefaults to min(4, available CPU cores), respecting container CPU quotas;<= 0means cores minus abs value (min 1).--report-summarystatuses:passed|queued|running|skipped|failure(failures carryprefix/message); non-requested tasks are keyed<dir>#<task>.Output is inherited when only one script can run at a time; otherwise piped. Use
--streamfor immediate prefixed output or--aggregate-output.
Cycles
A cycle fails before any script with ERR_PNPM_TASK_CYCLE. Set ignoreWorkspaceCycles: true only for deliberate cycles (pnpm warns and drops ordering among members).
Commands that ignore tasks
--no-sort and --parallel (implies --no-sort) ignore tasks declarations. Recursive exec has no script name so it doesn't join dependsOn, but still uses dependency-aware scheduling and --resume-from.
pnpm pipeline (v12.4.0, experimental)
Runs a named set of tasks the way a CI job would: frozen install, then the affected projects' task graph, with cached results restored.
tasks:
build: { dependsOn: ['^build'], outputs: ['dist/**'], inputs: ['src/**'], env: ['NODE_ENV'] }
test: { dependsOn: ['build'], outputs: [] }
lint: { outputs: [] }
pipelines:
default: [build, test, lint]
release: [build]pnpm pipeline # runs the "default" pipeline
pnpm pipeline release
pnpm pipeline --dry-run --json
pnpm pipeline --full # every project, not just affected-since-base
pnpm pipeline --base <ref> # affected diff base (default origin/main, or pipelineBase)
pnpm pipeline --no-cacheCaching: a task is cacheable only when it declares
outputs(outputs: []= "produces no files", makes a linter/test cacheable).inputsnarrows the cache key (+globadds to the default);envnames hashed vars;cache: falseopts out. The key also covers script text, dependency task keys, the lockfile, and the runtime. A hit restores files and replays logs.A plain recursive
pnpm runnever restores from the pipeline cache;outputs/inputs/env/cache/cargoTargetDirare read bypnpm pipelineonly.Remote cache: a
remoteCachesetting shares signed results through a Turborepo-API server (e.g. Vercel Remote Cache) or pnpr. Machines restore only results signed by theirtrustedKeys; CI publishes withPNPM_REMOTE_CACHE_URL/_TEAM/_TRUSTED_KEYS/_PRIVATE_KEY/_KEY_ID/_BUILDER_ID/_PUBLISH=true. Published results include output files and terminal logs. A missing, untrusted, or unreachable cache is just a miss.Accepts every
pnpm installoption (for its frozen install). Errors:ERR_PNPM_NO_PIPELINES,ERR_PNPM_UNKNOWN_PIPELINE,ERR_PNPM_PIPELINE_FAIL.--report/--report-to <url>submit run data;--repowith--watch/--once/--intervalwatches a repo.Cargo build state:
cargoTargetDir: targetkeeps a task's Cargo target dir between runs/worktrees via immutable snapshots.
Other dependency-aware commands
Workspace install, rebuild, pack, publish, stage, and lifecycle work start a project's work as soon as its workspace deps finish — following the package graph (not tasks), no longer waiting for unrelated topological groups.
<!-- Source references: - https://pnpm.io/workspace-task-orchestration - https://pnpm.io/cli/tasks - https://pnpm.io/cli/pipeline -->
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs Node.js
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Anthony Fu
- Publisher
- Anthony Fu (Community)
- Source
- antfu/skills · skills/pnpm · commit f63e9ec
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE.md)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Anthony Fu or Anthony Fu.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download pnpm.zip