omp packages

@clementprevot/pi-package-manager-guard0.1.3

Pi extension that gates Node package manager commands to the repo's manager

GitHub Actions Published 7 days ago MIT ~502 downloads/mo

Untested on omp

This is a pi package. No one has reported whether it works on omp yet. If you try it, add your result below.

Did it work for you?

Result

One report per person. A new report replaces your old one.

Reports 0

No reports yet.

Readme

@clementprevot/pi-package-manager-guard

A Pi extension that keeps the coding agent honest about package managers: when the agent runs a Node package manager command that does not match the manager your repo's lockfile declares, the command is paused and you decide.

Why

Agents mix up package managers constantly. In a Yarn repo they reach for npm install, in a pnpm repo they run bun add, and suddenly your lockfile has two managers in it and CI is red. This guard catches the mismatch before the command runs.

Install

pi install npm:@clementprevot/pi-package-manager-guard

Updates ship with pi update --extensions. The extension applies to your next session (quit and relaunch or issue a /reload command).

How it works

On every bash tool call, the extension:

  1. Walks up from the session's working directory to find the nearest lockfile (yarn.lock, pnpm-lock.yaml, bun.lockb, bun.lock, package-lock.json). It stops at the git root, so a stray lockfile in an enclosing folder does not leak in.
  2. Splits the command chain into subcommands (respecting quotes, so echo "use npm here" never trips the gate) and checks each one's package manager.
  3. Asks you what to do on a mismatch:
This repo uses yarn (lockfile) but the command uses npm. Allow?
> Yes, allow once
  Yes, allow for this session
  No, use yarn instead
  No, with a reason
  Stop

"No, with a reason" sends your free-text reason back to the agent, which is usually enough for it to correct itself without another round trip.

Exemptions

Commands that never touch the repo's dependencies are allowed through:

  • npx and bunx (runners)
  • yarn dlx and pnpm dlx
  • npm exec
  • Any command that is not a Node package manager (git, brew, ...)
  • Environment-variable prefixes are stripped first, so CI=1 npm install still gets gated

Outside a repo with a lockfile, the guard does nothing.

Configuration

None. The lockfile is the source of truth, by design.

Local development

npm install
npm test
npm run typecheck

To try the extension in a live session without installing it:

pi -e /path/to/this/repo

License

MIT