Move to pnpm dlx with a 5-day lag to skip the latest zero-day npm package exploits

bin/omarchy-npm-install

@@ -1,10 +1,10 @@
 #!/bin/bash
 
-# omarchy:summary=Install an npx wrapper for a given npm package.
+# omarchy:summary=Install a pnpm dlx wrapper for a given npm package.
 # omarchy:args=<package> [command-name]
 
 if [[ -z $1 ]]; then
-  echo "Usage: omarchy-npx-install <package> [command-name]"
+  echo "Usage: omarchy-npm-install <package> [command-name]"
   exit 1
 fi
 
@@ -23,8 +23,13 @@ if ! node_root="\$(mise where node@latest 2>/dev/null)"; then
   node_root="\$(mise where node@latest)"
 fi
 
-node_bin="\$node_root/bin/node"
+if omarchy-cmd-missing pnpm; then
-npx_bin="\$node_root/bin/npx"
+  echo "Installing pnpm for \$package..."
+  omarchy-pkg-add pnpm
+  hash -r
+fi
+
+export PNPM_CONFIG_MINIMUM_RELEASE_AGE=7200
 
 ensure_bin_runtime() {
   local bin_path=\$1
@@ -51,15 +56,15 @@ exec_package_bin() {
   fi
 }
 
-# Resolve the package bin inside npx, then run it with node@latest available for node shebangs.
+# Resolve the package bin inside pnpm dlx, then run it with node@latest available for node shebangs.
 # Some wrappers are aliases, e.g. playwright-cli wraps the playwright bin.
-"\$node_bin" "\$npx_bin" --yes --prefer-online --package "\$package" -- true
+PATH="\$node_root/bin:\$PATH" pnpm dlx --package "\$package" true
 
-package_bin_path=\$("\$node_bin" "\$npx_bin" --yes --package "\$package" -- which "\$package" 2>/dev/null)
+package_bin_path=\$(PATH="\$node_root/bin:\$PATH" pnpm dlx --package "\$package" which "\$package" 2>/dev/null)
 exec_package_bin "\$package_bin_path" "\$@"
 
 # Scoped packages like @openai/codex expose an unscoped bin like codex.
-package_bin_path=\$("\$node_bin" "\$npx_bin" --yes --package "\$package" -- which "\$command" 2>/dev/null)
+package_bin_path=\$(PATH="\$node_root/bin:\$PATH" pnpm dlx --package "\$package" which "\$command" 2>/dev/null)
 exec_package_bin "\$package_bin_path" "\$@"
 
 echo "Could not resolve npm bin for \$package / \$command" >&2

bin/omarchy-refresh-applications

@@ -19,6 +19,6 @@ fi
 bash $OMARCHY_PATH/install/packaging/icons.sh
 bash $OMARCHY_PATH/install/packaging/webapps.sh
 bash $OMARCHY_PATH/install/packaging/tuis.sh
-bash $OMARCHY_PATH/install/packaging/npx.sh
+bash $OMARCHY_PATH/install/packaging/npm.sh
 
 update-desktop-database ~/.local/share/applications

install/packaging/all.sh

@@ -4,7 +4,7 @@ run_logged $OMARCHY_INSTALL/packaging/nvim.sh
 run_logged $OMARCHY_INSTALL/packaging/icons.sh
 run_logged $OMARCHY_INSTALL/packaging/webapps.sh
 run_logged $OMARCHY_INSTALL/packaging/tuis.sh
-run_logged $OMARCHY_INSTALL/packaging/npx.sh
+run_logged $OMARCHY_INSTALL/packaging/npm.sh
 run_logged $OMARCHY_INSTALL/packaging/asus-rog.sh
 run_logged $OMARCHY_INSTALL/packaging/framework16.sh
 run_logged $OMARCHY_INSTALL/packaging/dell-xps-touchpad-haptics.sh

install/packaging/npm.sh

@@ -0,0 +1,8 @@
+omarchy-npm-install @openai/codex codex
+omarchy-npm-install @google/gemini-cli gemini
+omarchy-npm-install @github/copilot copilot
+omarchy-npm-install opencode-ai opencode
+omarchy-npm-install playwright playwright-cli
+omarchy-npm-install @earendil-works/pi-coding-agent pi
+omarchy-npm-install @kitlangton/ghui ghui
+omarchy-npm-install hunkdiff hunk

install/packaging/npx.sh

@@ -1,8 +0,0 @@
-omarchy-npx-install @openai/codex codex
-omarchy-npx-install @google/gemini-cli gemini
-omarchy-npx-install @github/copilot copilot
-omarchy-npx-install opencode-ai opencode
-omarchy-npx-install playwright playwright-cli
-omarchy-npx-install @earendil-works/pi-coding-agent pi
-omarchy-npx-install @kitlangton/ghui ghui
-omarchy-npx-install hunkdiff hunk

migrations/1773598247.sh

@@ -1,3 +0,0 @@
-echo "Install npx wrappers for AI CLI tools and playwright"
-
-source "$OMARCHY_PATH/install/packaging/npx.sh"

migrations/1775236589.sh

@@ -1,3 +0,0 @@
-echo "Update npx wrappers to run through mise node@latest"
-
-source "$OMARCHY_PATH/install/packaging/npx.sh"

migrations/1776348723.sh

@@ -1,3 +0,0 @@
-echo "Pin npx wrappers to the matching mise node runtime"
-
-source "$OMARCHY_PATH/install/packaging/npx.sh"

migrations/1777873457.sh

@@ -1,3 +0,0 @@
-echo "Install ghui (GitHub TUI) via npx wrapper"
-
-omarchy-npx-install @kitlangton/ghui ghui

migrations/1778487676.sh

@@ -1,3 +0,0 @@
-echo "Install hunkdiff npx wrapper as hunk"
-
-omarchy-npx-install hunkdiff hunk

migrations/1778516505.sh

@@ -0,0 +1,3 @@
+echo "Install npm package wrappers"
+
+source "$OMARCHY_PATH/install/packaging/npm.sh"