chore: switch to pnpm for security from npm (#85)

## Description

<!-- Provide a brief description of your changes -->

**Note:** PR titles should follow [Conventional
Commits](https://www.conventionalcommits.org/) format (e.g.,
`feat(devbox): add support for custom env vars` or `fix(snapshot):
resolve pagination issue`) as they are used for automatic release notes
generation.

## Type of Change

<!-- Mark the relevant option with an 'x' -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] Documentation update
- [ ] Code refactoring
- [ ] Performance improvement
- [ ] Test updates

## Related Issues

<!-- Link to related issues using #issue-number -->
Closes #

## Changes Made

<!-- Describe the changes in detail -->

## Testing

<!-- Describe how you tested your changes -->

- [ ] I have tested locally
- [ ] I have added/updated tests
- [ ] All existing tests pass

## Checklist

- [ ] My code follows the code style of this project
- [ ] I have performed a self-review of my own code
- [ ] I have commented my code, particularly in hard-to-understand areas
- [ ] I have updated the documentation accordingly
- [ ] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [ ] Any dependent changes have been merged and published

## Screenshots (if applicable)

<!-- Add screenshots to help explain your changes -->

## Additional Notes

<!-- Any additional information that reviewers should know -->

Author: dines-rl

.github/workflows/ci.yml

@@ -21,17 +21,20 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "20"
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Run Prettier check
-        run: npm run format:check
+        run: pnpm run format:check
 
   lint:
     runs-on: ubuntu-latest
@@ -46,17 +49,20 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "20"
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Run ESLint
-        run: npm run lint
+        run: pnpm run lint
 
   build:
     runs-on: ubuntu-latest
@@ -71,17 +77,20 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "20"
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build TypeScript
-        run: npm run build
+        run: pnpm run build
 
   test:
     runs-on: ubuntu-latest
@@ -97,17 +106,20 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "20"
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Run component tests with coverage
-        run: npm run test:components
+        run: pnpm run test:components
 
       - name: Upload coverage report
         uses: actions/upload-artifact@v6

.github/workflows/release.yml

@@ -32,18 +32,21 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "24"
           registry-url: "https://registry.npmjs.org"
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build
-        run: npm run build
+        run: pnpm run build
 
       - name: Publish to npm
-        run: npm publish
+        run: pnpm publish --no-git-checks

.husky/pre-push

@@ -2,27 +2,27 @@
 # This hook runs format:check, lint, and docs:commands
 
 echo "Running format:check..."
-if ! npm run format:check; then
+if ! pnpm run format:check; then
   echo ""
   echo "❌ Code formatting check failed"
-  echo "   Please run 'npm run format' to fix formatting issues"
+  echo "   Please run 'pnpm run format' to fix formatting issues"
   echo ""
   exit 1
 fi
 
 echo "Running lint..."
-if ! npm run lint; then
+if ! pnpm run lint; then
   echo ""
   echo "❌ Linting failed"
-  echo "   Please run 'npm run lint:fix' to fix linting issues"
+  echo "   Please run 'pnpm run lint:fix' to fix linting issues"
   echo ""
   exit 1
 fi
 
 echo "Running docs:commands to ensure README.md is up to date..."
 
 # Run the docs generation script
-npm run docs:commands
+pnpm run docs:commands
 
 # Check if README.md has uncommitted changes
 if ! git diff --quiet README.md; then

CLAUDE_SETUP.md

@@ -104,7 +104,8 @@ Make sure `rli` is in your PATH. Test by running `which rli` (macOS/Linux) or `w
 
 If not found:
 - If installed via npm globally: `npm install -g @runloop/rl-cli`
-- Check your npm global bin directory is in PATH: `npm config get prefix`
+- If installed via pnpm globally: `pnpm add -g @runloop/rl-cli`
+- Check your npm/pnpm global bin directory is in PATH
 
 ### "API key not configured"
 

CONTRIBUTING.md

@@ -7,7 +7,7 @@ Thank you for your interest in contributing to the Runloop CLI! This document pr
 ### Prerequisites
 
 - Node.js >= 18.0.0
-- npm
+- pnpm
 
 ### Development Setup
 
@@ -21,19 +21,19 @@ cd rl-cli
 2. Install dependencies:
 
 ```bash
-npm install
+pnpm install
 ```
 
 3. Build the project:
 
 ```bash
-npm run build
+pnpm run build
 ```
 
 4. Link for local development:
 
 ```bash
-npm link
+pnpm link --global
 ```
 
 Now you can use `rli` commands locally with your changes.
@@ -42,10 +42,10 @@ Now you can use `rli` commands locally with your changes.
 
 ```bash
 # Watch mode - rebuilds on file changes
-npm run dev
+pnpm run dev
 
 # Run the CLI
-npm start -- <command>
+pnpm start -- <command>
 
 # Or after linking
 rli <command>
@@ -59,33 +59,33 @@ This project uses Prettier and ESLint to maintain code quality.
 
 ```bash
 # Check formatting
-npm run format:check
+pnpm run format:check
 
 # Auto-fix formatting
-npm run format
+pnpm run format
 ```
 
 ### Linting
 
 ```bash
 # Run linter
-npm run lint
+pnpm run lint
 
 # Auto-fix lint issues
-npm run lint:fix
+pnpm run lint:fix
 ```
 
 ## Testing
 
 ```bash
 # Run all tests
-npm test
+pnpm test
 
 # Run component tests with coverage
-npm run test:components
+pnpm run test:components
 
 # Watch mode
-npm run test:watch
+pnpm run test:watch
 ```
 
 Please ensure all tests pass before submitting a pull request.

Dockerfile

@@ -10,17 +10,18 @@ RUN apt-get update && apt-get install -y \
     git \
     && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
     && apt-get install -y nodejs \
+    && npm install -g pnpm@9 \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # Set working directory
 WORKDIR /app
 
 # Copy package files first for better caching
-COPY package.json package-lock.json ./
+COPY package.json pnpm-lock.yaml ./
 
 # Install dependencies
-RUN npm ci
+RUN pnpm install --frozen-lockfile
 
 # Copy source code
 COPY . .

MCP_COMMANDS.md

@@ -143,8 +143,8 @@ Message endpoint: http://localhost:3000/message
 ### Command not found
 
 If you get "command not found: rli":
-- Install globally: `npm install -g @runloop/rl-cli`
-- Check your PATH includes npm global bin directory
+- Install globally: `npm install -g @runloop/rl-cli` or `pnpm add -g @runloop/rl-cli`
+- Check your PATH includes npm/pnpm global bin directory
 
 ### API key not configured
 

README.md

@@ -36,10 +36,12 @@ rli devbox delete <devbox-id>
 
 ## Installation
 
-Install globally via npm:
+Install globally via npm or pnpm:
 
 ```bash
 npm install -g @runloop/rl-cli
+# or
+pnpm add -g @runloop/rl-cli
 ```
 
 ## Setup
@@ -197,13 +199,13 @@ The TUI supports both light and dark terminal themes and will automatically sele
 
 ```bash
 # Install dependencies
-npm install
+pnpm install
 
 # Build
-npm run build
+pnpm run build
 
 # Watch mode
-npm run dev
+pnpm run dev
 
 ## Contributing