From the skill’s files
Taken from the skill’s own files (its description, section headings and stated usage). Not an AutoGineer summary, and not written by the author as one.
Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, or managing dependencies with catalogs, patches, overrides, config dependencies, or the global virtual store. pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, and enforces strict dependency resolution by default, preventing phantom dependencies.
What it does
- Core
- Features
- Best Practices
When to use it
- Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, or managing dependencies with catalogs, patches, overrides, config dependencies, or the global virtual store.
Advantages
The skill’s files do not state this.
Usage examples
The skill’s files do not state this.
Install
Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/antfu/pnpm/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip pnpm.zip -d .agents/skills
Documentation by Anthony Fu
pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, and enforces strict dependency resolution by default, preventing phantom dependencies.
pnpm v12 is a Rust rewrite of v11: stable, and keeps v11's commands, flags, settings, and lockfile format — so most guidance here applies to both. A handful of v12 behaviors differ (git deps resolve via HTTPS, project-aware global bins, other package managers, packageImportMethod: auto hardlinks first on Linux) — see best-practices-migration.
Configuration model (important): pnpm settings live in pnpm-workspace.yaml (and the global config.yaml) using camelCase keys. .npmrc is used only for authentication/registry credentials, and the pnpm field of package.json is no longer read. When working in a pnpm project, check pnpm-workspace.yaml for settings/workspace structure and .npmrc only for auth. Always use --frozen-lockfile (or pnpm ci) in CI.
The skill is based on pnpm 12.18, generated at 2026-11-05. It covers v11+v12 behavior (config split, config includes, isolated global packages,
allowBuilds,pmOnFail, global virtual store, native release management, workspace task orchestration, and experimental Python/Cargo support) where current docs describe them.
Core
| Topic | Description | Reference |
|---|---|---|
| CLI Commands | install/add/remove/update, run, dlx/pnx, workspace, runtime, publishing (version, view, sbom, stage) | core-cli |
| Configuration | pnpm-workspace.yaml settings (camelCase), global config.yaml, config includes, packageConfigs, auth (.npmrc, auth.ini) | core-config |
| Workspaces | Monorepo support: filtering, workspace protocol, shared lockfile, packageConfigs | core-workspaces |
| Store | Content-addressable store, virtual store, node linker modes (incl. loaded/store loader), frozen/read-only store | core-store |
Features
| Topic | Description | Reference |
|---|---|---|
| Catalogs | Centralized dependency versions; catalogMode, catalog: in overrides | features-catalogs |
| Overrides | Force versions (incl. transitive & peer deps); packageExtensions | features-overrides |
| Patches | Modify third-party packages; patchedDependencies in pnpm-workspace.yaml | features-patches |
| Aliases | Install under custom names (npm:) and registry aliases (namedRegistries) | features-aliases |
| Hooks | .pnpmfile.mjs hooks (readPackage, updateConfig, beforePacking), finders, resolvers/fetchers | features-hooks |
| Peer Dependencies | Auto-install, strict mode, rules, dedupePeers, peers check | features-peer-deps |
| Config Dependencies | Share hooks/settings/catalogs/patches across repos via configDependencies | features-config-dependencies |
| Global Virtual Store & Shims | Shared node_modules, git-worktree multi-agent setups, isolated global packages, project-aware bins, other package managers | features-global-virtual-store |
| Supply-Chain Security | Build approval (allowBuilds), permissions and agent skills, minimumReleaseAge, trustPolicy, lockfile integrity | features-supply-chain-security |
| Task Orchestration | Cross-project task graphs (tasks/dependsOn), concurrency groups, priority, pnpm pipeline | features-task-orchestration |
| Release Management | Native versioning: pnpm change/version -r/lane, lanes, epics, fixed groups | features-versioning |
| Multi-Ecosystem | Python (pypi:) and Cargo (crate:) dependencies alongside npm (experimental) | features-multi-ecosystem |
Best Practices
| Topic | Description | Reference |
|---|---|---|
| CI/CD Setup | GitHub Actions, GitLab, Docker, pnpm ci, store caching, frozen lockfiles | best-practices-ci |
| Migration | npm/Yarn → pnpm, phantom deps, and pnpm v10 → v11 → v12 upgrade notes | best-practices-migration |
| Performance | Install optimizations, allowBuilds, global virtual store, workspace parallelization | best-practices-performance |
Files
- ATTRIBUTION.mdAdded by AutoGineer889 B
- GENERATION.md134 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md5.1 KiB
- references/best-practices-ci.md9.7 KiB
- references/best-practices-migration.md9.9 KiB
- references/best-practices-performance.md6.0 KiB
- references/core-cli.md11.3 KiB
- references/core-config.md12.8 KiB
- references/core-store.md10.7 KiB
- references/core-workspaces.md6.6 KiB
- references/features-aliases.md4.4 KiB
- references/features-catalogs.md5.0 KiB
- references/features-config-dependencies.md4.2 KiB
- references/features-global-virtual-store.md10.0 KiB
- references/features-hooks.md8.9 KiB
- references/features-multi-ecosystem.md6.2 KiB
- references/features-overrides.md5.5 KiB
- references/features-patches.md5.0 KiB
- references/features-peer-deps.md5.9 KiB
- references/features-supply-chain-security.md7.7 KiB
- references/features-task-orchestration.md6.8 KiB
- references/features-versioning.md5.5 KiB
references/best-practices-performance.md
name: pnpm-performance-optimization description: Tips and tricks for faster installs and better performance
pnpm Performance Optimization
pnpm is fast by default, but these optimizations can make it even faster.
Install Optimizations
Use Frozen Lockfile
Skip resolution when lockfile exists:
pnpm install --frozen-lockfileThis is faster because pnpm skips the resolution phase entirely.
Prefer Offline Mode
Use cached packages when available:
pnpm install --prefer-offlineSkip Optional Dependencies
If you don't need optional deps:
pnpm install --no-optional # or `optional: false` in pnpm-workspace.yamlOn pnpm 12, --force still skips optional deps built for other platforms unless forceIgnoresPlatform: true; prefer supportedArchitectures to install other platforms on purpose.
Skip Scripts
For CI or when scripts aren't needed:
pnpm install --ignore-scriptsCaution: Some packages require postinstall scripts to work correctly.
Only Build Specific Dependencies
Build-script approval is a single allowBuilds map (replaces onlyBuiltDependencies/neverBuiltDependencies). Only allowed packages run install scripts:
allowBuilds:
esbuild: true
'@swc/core': true
core-js: false # explicitly skipPackages not listed are treated as unreviewed (blocked by default). See features-supply-chain-security for the full build-approval workflow.
Store Optimizations
Side Effects Cache
Cache native module build results (enabled by default):
sideEffectsCache: trueThis caches the results of postinstall scripts, speeding up subsequent installs. Object form: read, write, remote, and exclude (v12.14.0) for packages whose build depends on things pnpm cannot key on, such as system libraries:
sideEffectsCache:
exclude: ['[email protected] || 2.0.0', '@native/*'] # always built locally, never cachedBuilds can also be shared across machines with sideEffectsCache.remote and the remoteCache setting (v12.12.0; a pnpr server or a Turborepo Remote Cache API server such as Vercel). Publishing and signing keys may only be set in global config or env.
Global Virtual Store
For many checkouts of the same repo (e.g. git worktrees / multiple agents), enable the global virtual store so each project's node_modules is just symlinks into one shared store — near-zero per-checkout cost. Auto-disabled in CI. Only applies with nodeLinker: isolated; pnpm dlx/pnx do not use it.
virtualStoreType: globalShared Store
A single content-addressable store is used for all projects by default:
storeDir: ~/.local/share/pnpm/storeBenefits: packages downloaded once, hard links save disk space, faster cached installs.
Store Maintenance
Periodically clean unused packages:
# Remove unreferenced packages
pnpm store prune
# Check store integrity
pnpm store statusWorkspace Optimizations
Parallel Execution
Run workspace scripts in parallel:
pnpm -r --parallel run buildControl concurrency:
workspaceConcurrency: 8Stream Output
See output in real-time:
pnpm -r --stream run buildFilter to Changed Packages
Only build what changed:
# Build packages changed since main branch
pnpm --filter "...[origin/main]" run buildTopological Order
Build dependencies before dependents:
pnpm -r run build
# Automatically runs in topological orderFor explicit sequential builds:
pnpm -r --workspace-concurrency=1 run buildNetwork Optimizations
Network/registry settings are camelCase in pnpm-workspace.yaml (registry URLs may also go in registries):
registries:
default: https://registry.npmmirror.com/
fetchRetries: 3
fetchRetryMintimeout: 10000
fetchRetryMaxtimeout: 60000
networkConcurrency: 64 # auto: clamp(workers x 3, 64, 96)
httpProxy: http://proxy.company.com:8080
httpsProxy: http://proxy.company.com:8080Lockfile Optimization
Single Lockfile (Monorepos)
Use shared lockfile for all packages (default):
sharedWorkspaceLockfile: trueBenefits:
Single source of truth
Faster resolution
Consistent versions across workspace
Lockfile-only Mode
Only update lockfile without installing:
pnpm install --lockfile-onlyBenchmarking
Compare Install Times
# Clean install
rm -rf node_modules pnpm-lock.yaml
time pnpm install
# Cached install (with lockfile)
rm -rf node_modules
time pnpm install --frozen-lockfile
# With store cache
time pnpm install --frozen-lockfile --prefer-offlineProfile Resolution
Debug slow installs:
# Verbose logging
pnpm install --reporter=append-only
# Debug mode
DEBUG=pnpm:* pnpm installConfiguration Summary
Optimized pnpm-workspace.yaml for performance:
# Install behavior
autoInstallPeers: true
sideEffectsCache: true
optimisticRepeatInstall: true
# Build approval (only what's necessary)
allowBuilds:
esbuild: true
'@swc/core': true
# Network
fetchRetries: 3
networkConcurrency: 64
# Workspace
workspaceConcurrency: 4
# Many checkouts of the same repo
virtualStoreType: globalQuick Reference
| Scenario | Command/Setting |
|---|---|
| CI installs | pnpm ci / pnpm install --frozen-lockfile |
| Offline development | --prefer-offline |
| Control native builds | allowBuilds map |
| Parallel workspace | pnpm -r --parallel run build |
| Build changed only | pnpm --filter "...[origin/main]" build |
| Clean store | pnpm store prune |
| Many worktrees/agents | virtualStoreType: global |
<!-- Source references: - https://pnpm.io/settings - https://pnpm.io/cli/install - https://pnpm.io/filtering - https://pnpm.io/global-virtual-store -->
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs Node.js
Security
What our scanner noticed· Low risk
- Instructions that use the network
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Anthony Fu
- Publisher
- Anthony Fu (Community)
- Source
- antfu/skills · skills/pnpm · commit f63e9ec
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE.md)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Anthony Fu.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download pnpm.zip