From 8d5e9e794e2c2e8ee603cdc95a681086ee49cbe5 Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Tue, 12 May 2026 23:58:23 +0200 Subject: [PATCH] Move to pnpm dlx with a 5-day lag to skip the latest zero-day npm package exploits --- ...marchy-npx-install => omarchy-npm-install} | 21 ++++++++++++------- bin/omarchy-refresh-applications | 2 +- install/packaging/all.sh | 2 +- install/packaging/npm.sh | 8 +++++++ install/packaging/npx.sh | 8 ------- migrations/1773598247.sh | 3 --- migrations/1775236589.sh | 3 --- migrations/1776348723.sh | 3 --- migrations/1777873457.sh | 3 --- migrations/1778487676.sh | 3 --- migrations/1778516505.sh | 3 +++ 11 files changed, 26 insertions(+), 33 deletions(-) rename bin/{omarchy-npx-install => omarchy-npm-install} (65%) create mode 100644 install/packaging/npm.sh delete mode 100644 install/packaging/npx.sh delete mode 100644 migrations/1773598247.sh delete mode 100644 migrations/1775236589.sh delete mode 100644 migrations/1776348723.sh delete mode 100644 migrations/1777873457.sh delete mode 100644 migrations/1778487676.sh create mode 100644 migrations/1778516505.sh diff --git a/bin/omarchy-npx-install b/bin/omarchy-npm-install similarity index 65% rename from bin/omarchy-npx-install rename to bin/omarchy-npm-install index 6c0101d6..7ac6cdbc 100755 --- a/bin/omarchy-npx-install +++ b/bin/omarchy-npm-install @@ -1,10 +1,10 @@ #!/bin/bash -# omarchy:summary=Install an npx wrapper for a given npm package. +# omarchy:summary=Install a pnpm dlx wrapper for a given npm package. # omarchy:args= [command-name] if [[ -z $1 ]]; then - echo "Usage: omarchy-npx-install [command-name]" + echo "Usage: omarchy-npm-install [command-name]" exit 1 fi @@ -23,8 +23,13 @@ if ! node_root="\$(mise where node@latest 2>/dev/null)"; then node_root="\$(mise where node@latest)" fi -node_bin="\$node_root/bin/node" -npx_bin="\$node_root/bin/npx" +if omarchy-cmd-missing pnpm; then + echo "Installing pnpm for \$package..." + omarchy-pkg-add pnpm + hash -r +fi + +export PNPM_CONFIG_MINIMUM_RELEASE_AGE=7200 ensure_bin_runtime() { local bin_path=\$1 @@ -51,15 +56,15 @@ exec_package_bin() { fi } -# Resolve the package bin inside npx, then run it with node@latest available for node shebangs. +# Resolve the package bin inside pnpm dlx, then run it with node@latest available for node shebangs. # Some wrappers are aliases, e.g. playwright-cli wraps the playwright bin. -"\$node_bin" "\$npx_bin" --yes --prefer-online --package "\$package" -- true +PATH="\$node_root/bin:\$PATH" pnpm dlx --package "\$package" true -package_bin_path=\$("\$node_bin" "\$npx_bin" --yes --package "\$package" -- which "\$package" 2>/dev/null) +package_bin_path=\$(PATH="\$node_root/bin:\$PATH" pnpm dlx --package "\$package" which "\$package" 2>/dev/null) exec_package_bin "\$package_bin_path" "\$@" # Scoped packages like @openai/codex expose an unscoped bin like codex. -package_bin_path=\$("\$node_bin" "\$npx_bin" --yes --package "\$package" -- which "\$command" 2>/dev/null) +package_bin_path=\$(PATH="\$node_root/bin:\$PATH" pnpm dlx --package "\$package" which "\$command" 2>/dev/null) exec_package_bin "\$package_bin_path" "\$@" echo "Could not resolve npm bin for \$package / \$command" >&2 diff --git a/bin/omarchy-refresh-applications b/bin/omarchy-refresh-applications index 9eb4e9de..a4315f8f 100755 --- a/bin/omarchy-refresh-applications +++ b/bin/omarchy-refresh-applications @@ -19,6 +19,6 @@ fi bash $OMARCHY_PATH/install/packaging/icons.sh bash $OMARCHY_PATH/install/packaging/webapps.sh bash $OMARCHY_PATH/install/packaging/tuis.sh -bash $OMARCHY_PATH/install/packaging/npx.sh +bash $OMARCHY_PATH/install/packaging/npm.sh update-desktop-database ~/.local/share/applications diff --git a/install/packaging/all.sh b/install/packaging/all.sh index d1db1b91..cb377033 100644 --- a/install/packaging/all.sh +++ b/install/packaging/all.sh @@ -4,7 +4,7 @@ run_logged $OMARCHY_INSTALL/packaging/nvim.sh run_logged $OMARCHY_INSTALL/packaging/icons.sh run_logged $OMARCHY_INSTALL/packaging/webapps.sh run_logged $OMARCHY_INSTALL/packaging/tuis.sh -run_logged $OMARCHY_INSTALL/packaging/npx.sh +run_logged $OMARCHY_INSTALL/packaging/npm.sh run_logged $OMARCHY_INSTALL/packaging/asus-rog.sh run_logged $OMARCHY_INSTALL/packaging/framework16.sh run_logged $OMARCHY_INSTALL/packaging/dell-xps-touchpad-haptics.sh diff --git a/install/packaging/npm.sh b/install/packaging/npm.sh new file mode 100644 index 00000000..7ffdc315 --- /dev/null +++ b/install/packaging/npm.sh @@ -0,0 +1,8 @@ +omarchy-npm-install @openai/codex codex +omarchy-npm-install @google/gemini-cli gemini +omarchy-npm-install @github/copilot copilot +omarchy-npm-install opencode-ai opencode +omarchy-npm-install playwright playwright-cli +omarchy-npm-install @earendil-works/pi-coding-agent pi +omarchy-npm-install @kitlangton/ghui ghui +omarchy-npm-install hunkdiff hunk diff --git a/install/packaging/npx.sh b/install/packaging/npx.sh deleted file mode 100644 index cb65803b..00000000 --- a/install/packaging/npx.sh +++ /dev/null @@ -1,8 +0,0 @@ -omarchy-npx-install @openai/codex codex -omarchy-npx-install @google/gemini-cli gemini -omarchy-npx-install @github/copilot copilot -omarchy-npx-install opencode-ai opencode -omarchy-npx-install playwright playwright-cli -omarchy-npx-install @earendil-works/pi-coding-agent pi -omarchy-npx-install @kitlangton/ghui ghui -omarchy-npx-install hunkdiff hunk diff --git a/migrations/1773598247.sh b/migrations/1773598247.sh deleted file mode 100644 index 5a57a07c..00000000 --- a/migrations/1773598247.sh +++ /dev/null @@ -1,3 +0,0 @@ -echo "Install npx wrappers for AI CLI tools and playwright" - -source "$OMARCHY_PATH/install/packaging/npx.sh" diff --git a/migrations/1775236589.sh b/migrations/1775236589.sh deleted file mode 100644 index f78ef54b..00000000 --- a/migrations/1775236589.sh +++ /dev/null @@ -1,3 +0,0 @@ -echo "Update npx wrappers to run through mise node@latest" - -source "$OMARCHY_PATH/install/packaging/npx.sh" diff --git a/migrations/1776348723.sh b/migrations/1776348723.sh deleted file mode 100644 index 8900c9c3..00000000 --- a/migrations/1776348723.sh +++ /dev/null @@ -1,3 +0,0 @@ -echo "Pin npx wrappers to the matching mise node runtime" - -source "$OMARCHY_PATH/install/packaging/npx.sh" diff --git a/migrations/1777873457.sh b/migrations/1777873457.sh deleted file mode 100644 index 5c185abe..00000000 --- a/migrations/1777873457.sh +++ /dev/null @@ -1,3 +0,0 @@ -echo "Install ghui (GitHub TUI) via npx wrapper" - -omarchy-npx-install @kitlangton/ghui ghui diff --git a/migrations/1778487676.sh b/migrations/1778487676.sh deleted file mode 100644 index 721991ad..00000000 --- a/migrations/1778487676.sh +++ /dev/null @@ -1,3 +0,0 @@ -echo "Install hunkdiff npx wrapper as hunk" - -omarchy-npx-install hunkdiff hunk diff --git a/migrations/1778516505.sh b/migrations/1778516505.sh new file mode 100644 index 00000000..6f8acf62 --- /dev/null +++ b/migrations/1778516505.sh @@ -0,0 +1,3 @@ +echo "Install npm package wrappers" + +source "$OMARCHY_PATH/install/packaging/npm.sh"