@saadnvd1/agent-os 0.3.680 → 0.3.691

package/lib/tasks/pause.ts

@@ -74,13 +74,11 @@ const nudge = () =>
 
 const sessionOf = (id: string) =>
   db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-    | Session
-    | undefined;
+    Session | undefined;
 
 const pauseRow = (id: number) =>
   db.prepare(`SELECT * FROM task_pauses WHERE id = ?`).get(id) as
-    | TaskPause
-    | undefined;
+    TaskPause | undefined;
 
 // SQLite's datetime('now') is UTC without a zone.
 const ms = (v: string | null | undefined) =>
@@ -400,8 +398,7 @@ export function setPauseNote(sessionId: string, note: string | null): void {
 }
 
 export type ResumeOutcome =
-  | { outcome: "resumed" | "cancelled" }
-  | { outcome: "held"; note: string };
+  { outcome: "resumed" | "cancelled" } | { outcome: "held"; note: string };
 
 // A deliberate Resume, by a person or the orchestrator: starts at once, past
 // the slot limit, like Start now. A machine in the red still holds it: it is

package/lib/tasks/pr-activity.ts

@@ -59,9 +59,7 @@ export async function fingerprints(
   );
   for (const n of prs) {
     const pr = res.data?.repository?.[`p${n}`] as
-      | { createdAt: string; reviews: Last; comments: Last }
-      | null
-      | undefined;
+      { createdAt: string; reviews: Last; comments: Last } | null | undefined;
     if (!pr) continue;
     const part = (l: Last) => `${l.totalCount}:${l.nodes[0]?.id ?? ""}`;
     out.set(n, {

package/lib/tasks/queue-rows.ts

@@ -14,13 +14,11 @@ export const IN_FLIGHT = ["running", "moving"];
 
 export const row = (id: string) =>
   db.prepare(`SELECT * FROM task_queue WHERE id = ?`).get(id) as
-    | QueueRow
-    | undefined;
+    QueueRow | undefined;
 
 export const sessionOf = (id: string) =>
   db.prepare(`SELECT * FROM session_rows WHERE id = ?`).get(id) as
-    | Session
-    | undefined;
+    Session | undefined;
 
 export function patch(id: string, fields: Partial<QueueRow>): void {
   const keys = Object.keys(fields);

package/lib/tasks/queue-types.ts

@@ -6,11 +6,7 @@ import type { Priority, WaitCode } from "./schedule-types";
 import type { StartVia } from "./starter";
 
 export type QueueStatus =
-  | "queued"
-  | "starting"
-  | "started"
-  | "failed"
-  | "removed";
+  "queued" | "starting" | "started" | "failed" | "removed";
 
 export interface QueueRow {
   id: string;

package/lib/tasks/queue.ts

@@ -313,8 +313,7 @@ export function moveQueued(id: string, by: -1 | 1): void {
          ORDER BY q.position ${by < 0 ? "DESC" : "ASC"} LIMIT 1`
       )
       .get({ position: r.position, ws: workspaceId, project: r.project_id }) as
-      | QueueRow
-      | undefined;
+      QueueRow | undefined;
     if (!other) return;
     patch(r.id, { position: other.position });
     patch(other.id, { position: r.position });

package/lib/tasks/refresh-base.ts

@@ -16,8 +16,7 @@ import { restackBranch, outputOf, type Runner } from "../stacks/git";
 import { run } from "./gh";
 
 export type RefreshResult =
-  | { moved: false; note?: string }
-  | { moved: true; how: "reset" | "rebase" };
+  { moved: false; note?: string } | { moved: true; how: "reset" | "rebase" };
 
 export interface RefreshTarget {
   name: string;

package/lib/tasks/setup.ts

@@ -20,8 +20,10 @@ const tail = (s: string, n: number) => (s.length > n ? `...${s.slice(-n)}` : s);
 export function setupOutcome(result: SetupResult | Error): TaskSetup {
   if (result instanceof Error)
     return { status: "failed", ms: null, error: redact(result.message) };
-  if (result.success)
-    return { status: "ok", ms: result.durationMs, error: null };
+  if (result.success) {
+    const warning = result.steps.find((s) => s.warning)?.warning;
+    return { status: "ok", ms: result.durationMs, error: warning ?? null };
+  }
   const failed = result.steps.filter((s) => !s.success);
   const last = failed[failed.length - 1];
   const error = last
@@ -31,6 +33,11 @@ export function setupOutcome(result: SetupResult | Error): TaskSetup {
 }
 
 export function setupNote(setup: TaskSetup): string {
+  if (setup.status === "ok" && setup.error)
+    return `
+
+---
+Note from AgentOS: ${setup.error}`;
   if (setup.status !== "failed") return "";
   return `
 

package/lib/tasks/start.ts

@@ -60,8 +60,7 @@ export function launchHold(sessionId: string): string | null {
        LIMIT 1`
     )
     .get(sessionId, sessionId, sessionId) as
-    | { workspace_id: string }
-    | undefined;
+    { workspace_id: string } | undefined;
   if (!row) return null;
   if (isPaused(row.workspace_id)) return "the orchestrator is paused by Saad";
   const window = brakesEnabled() ? windowRefusal(readUsage()) : null;
@@ -135,8 +134,7 @@ export async function finishTaskStart(
   const now = db
     .prepare(`SELECT task_status, archived_at FROM session_rows WHERE id = ?`)
     .get(sessionId) as
-    | { task_status: string | null; archived_at: string | null }
-    | undefined;
+    { task_status: string | null; archived_at: string | null } | undefined;
   if (now?.task_status !== "running" || now.archived_at)
     return done({
       status: "failed",

package/lib/tasks/starter.ts

@@ -102,8 +102,7 @@ export function orchestratorOf(startedBy: string | null | undefined) {
     const row = db
       .prepare(`SELECT role, started_by FROM sessions WHERE id = ?`)
       .get(id) as
-      | { role: string | null; started_by: string | null }
-      | undefined;
+      { role: string | null; started_by: string | null } | undefined;
     if (!row) return null;
     if (row.role === "orchestrator") return id;
     id = row.started_by;

package/lib/tasks/state.ts

@@ -1,12 +1,7 @@
 import type { AttributionKind } from "./code-review";
 
 export type TaskStatus =
-  | "running"
-  | "merged"
-  | "dropped"
-  | "done"
-  | "moving"
-  | "moved";
+  "running" | "merged" | "dropped" | "done" | "moving" | "moved";
 
 export type ChecksVerdict = "pass" | "fail" | "pending" | "none";
 

package/lib/theme-config.ts

@@ -30,14 +30,7 @@ export type DarkThemeVariant =
   | "ocean"
   | "mocha";
 export type LightThemeVariant =
-  | "default"
-  | "warm"
-  | "cool"
-  | "soft"
-  | "rose"
-  | "lavender"
-  | "mint"
-  | "peach";
+  "default" | "warm" | "cool" | "soft" | "rose" | "lavender" | "mint" | "peach";
 export type Theme =
   | "light"
   | `light-${LightThemeVariant}`

package/lib/updates/banner.ts

@@ -68,12 +68,7 @@ export interface UpdateView {
 }
 
 export type BannerState =
-  | "hidden"
-  | "available"
-  | "pending"
-  | "running"
-  | "failed"
-  | "built";
+  "hidden" | "available" | "pending" | "running" | "failed" | "built";
 
 export const DISMISSED_VERSION_KEY = "agentos.update.dismissed";
 export const DISMISSED_RUN_KEY = "agentos.update.dismissedRun";

package/lib/updates/run.ts

@@ -264,8 +264,7 @@ export async function preflight(
 // ── starting ─────────────────────────────────────────────────────────────
 
 export type StartResult =
-  | { ok: true; pending: boolean }
-  | ({ ok: false } & Refusal);
+  { ok: true; pending: boolean } | ({ ok: false } & Refusal);
 
 /** Takes the right to start, atomically, so two requests can't both run. */
 function claimStart(deps: Pick<RunDeps, "stateFile" | "now">): boolean {

package/lib/usage/aggregate.ts

@@ -76,7 +76,7 @@ export function aggregateUsage(
   const since = rangeStart(range, now);
   const total = acc();
   const days = new Map<string, Acc>();
-  for (let t = since; t <= now; ) {
+  for (let t = since; t <= now;) {
     days.set(dayKey(t), acc());
     const next = new Date(t);
     next.setDate(next.getDate() + 1);

package/lib/usage/nightly.ts

@@ -45,8 +45,7 @@ const addDays = (day: string, n: number) =>
 
 function setting(key: string): string | null {
   const r = db.prepare(`SELECT value FROM settings WHERE key = ?`).get(key) as
-    | { value: string }
-    | undefined;
+    { value: string } | undefined;
   return r?.value ?? null;
 }
 

package/lib/usage/rate-limits.ts

@@ -160,8 +160,7 @@ export function lastReading(
        WHERE window = ? AND at <= ? ORDER BY at DESC, id DESC LIMIT 1`
     )
     .get(window, before) as
-    | { at: number; utilization: number; resets_at: number | null }
-    | undefined;
+    { at: number; utilization: number; resets_at: number | null } | undefined;
   return r
     ? { at: r.at, utilization: r.utilization, resetsAt: r.resets_at }
     : null;

package/lib/usage/turns.ts

@@ -111,8 +111,7 @@ export function recordCompaction(
   const current = db
     .prepare(`SELECT name, workspace_id FROM sessions WHERE id = ?`)
     .get(session.id) as
-    | { name: string; workspace_id: string | null }
-    | undefined;
+    { name: string; workspace_id: string | null } | undefined;
   db.prepare(
     `INSERT INTO chat_compactions (session_id, session_name, workspace_id, at, trigger, phase, before_tokens, after_tokens)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`

package/lib/usage/windows.ts

@@ -101,13 +101,11 @@ async function planLimits(): Promise<Cached> {
   if (cache && Date.now() - cache.at < TTL_MS) return cache;
   inflight ??= askAgent()
     .then((limits): Cached => ({ at: Date.now(), limits }))
-    .catch(
-      (error: unknown): Cached => ({
-        at: Date.now(),
-        limits: null,
-        error: error instanceof Error ? error.message : String(error),
-      })
-    )
+    .catch((error: unknown): Cached => ({
+      at: Date.now(),
+      limits: null,
+      error: error instanceof Error ? error.message : String(error),
+    }))
     .then((c) => (cache = c))
     .finally(() => {
       inflight = null;

package/lib/workspaces.ts

@@ -53,8 +53,7 @@ export function listWorkspaces(): Workspace[] {
 
 export function getWorkspace(id: string): Workspace | null {
   const row = db.prepare(`SELECT * FROM workspaces WHERE id = ?`).get(id) as
-    | WorkspaceRow
-    | undefined;
+    WorkspaceRow | undefined;
   return row ? toWorkspace(row) : null;
 }
 

package/lib/worktree-deps/clone.ts

@@ -236,6 +236,16 @@ export async function cloneDeps(opts: {
 // not, and cloning it would hand the worktree missing dependencies. Other
 // package managers have no hidden lockfile to check, so they pass.
 export async function nodeModulesMatchLock(dir: string): Promise<boolean> {
+  // pnpm copies the lockfile it installed from into node_modules/.pnpm.
+  const pnpmLock = await fs.promises
+    .readFile(path.join(dir, "pnpm-lock.yaml"), "utf-8")
+    .catch(() => null);
+  if (pnpmLock !== null) {
+    const installed = await fs.promises
+      .readFile(path.join(dir, "node_modules", ".pnpm", "lock.yaml"), "utf-8")
+      .catch(() => null);
+    return installed === pnpmLock;
+  }
   const read = (file: string) =>
     fs.promises
       .readFile(file, "utf-8")

package/lib/worktree-deps/fastcopy.ts

@@ -22,7 +22,14 @@ export const STORE_ROOT = agentosHome("deps-store");
 
 // Files tools rewrite in place. A hardlink would carry the write back into
 // the store, so these are real copies in every worktree.
-export const MUTABLE_IN_MODULES = [".package-lock.json", ".cache", ".vite"];
+export const MUTABLE_IN_MODULES = [
+  ".package-lock.json",
+  ".modules.yaml",
+  ".pnpm/lock.yaml",
+  ".pnpm-workspace-state-v1.json",
+  ".cache",
+  ".vite",
+];
 
 const probed = new Map<string, boolean>();
 

package/lib/worktree-deps/index.ts

@@ -7,7 +7,7 @@ import { exec } from "child_process";
 import { promisify } from "util";
 import type { SetupResult } from "../env-setup";
 import { NO_FAST_COPY, cloneDeps } from "./clone";
-import { detectPackageManager, setupEnv } from "./install";
+import { detectPackageManager, setupEnv, shellCommand } from "./install";
 
 const execAsync = promisify(exec);
 
@@ -47,8 +47,8 @@ export async function runCommand(
 
 /**
  * Clone the main checkout's node_modules (or exactly agentos.json's `clone`
- * paths), or else install: the lockfile's frozen install first, then a
- * plain one.
+ * paths), or else install: the lockfile's frozen install first, then (for
+ * a project other than AgentOS) a plain one.
  */
 export async function bringDependencies(
   result: SetupResult,
@@ -81,20 +81,15 @@ export async function bringDependencies(
     return;
   }
 
-  let error: string | undefined;
-  for (const command of pm.installs) {
-    const run = await deps.run(command, worktreePath, envVars);
-    result.steps.push({
-      name: `Install dependencies (${pm.name})`,
-      command,
-      success: run.success,
-      output: [clone.reason && `Not cloned: ${clone.reason}`, run.output]
-        .filter(Boolean)
-        .join("\n"),
-      error: run.error,
-    });
-    if (run.success) return;
-    error = run.error;
-  }
-  if (error !== undefined) result.success = false;
+  const run = await deps.run(shellCommand(pm.install), worktreePath, envVars);
+  result.steps.push({
+    name: `Install dependencies (${pm.name})`,
+    command: pm.install,
+    success: run.success,
+    output: [clone.reason && `Not cloned: ${clone.reason}`, run.output]
+      .filter(Boolean)
+      .join("\n"),
+    error: run.error,
+  });
+  if (!run.success) result.success = false;
 }

package/lib/worktree-deps/install.ts

@@ -1,6 +1,8 @@
 /**
  * Installing a worktree's dependencies when they can't be cloned: the
- * lockfile's own frozen install first, then a plain install.
+ * lockfile's own frozen install, and nothing else. A plain install would
+ * resolve ranges to versions newer than the lockfile, so a lockfile that
+ * disagrees with package.json fails setup and the agent is told.
  */
 
 import * as fs from "fs";
@@ -8,8 +10,7 @@ import * as path from "path";
 
 export interface PackageManager {
   name: "bun" | "pnpm" | "yarn" | "npm";
-  // Tried in order until one succeeds: frozen to the lockfile, then plain.
-  installs: string[];
+  install: string;
 }
 
 // Each install includes devDependencies: the agent needs typecheck, tests
@@ -17,44 +18,29 @@ export interface PackageManager {
 const BY_LOCKFILE: Array<{ file: string; pm: PackageManager }> = [
   {
     file: "bun.lock",
-    pm: {
-      name: "bun",
-      installs: ["bun install --frozen-lockfile", "bun install"],
-    },
+    pm: { name: "bun", install: "bun install --frozen-lockfile" },
   },
   {
     file: "bun.lockb",
-    pm: {
-      name: "bun",
-      installs: ["bun install --frozen-lockfile", "bun install"],
-    },
+    pm: { name: "bun", install: "bun install --frozen-lockfile" },
   },
   {
     file: "pnpm-lock.yaml",
     pm: {
       name: "pnpm",
-      installs: [
-        "pnpm install --frozen-lockfile --prod=false",
-        "pnpm install --prod=false",
-      ],
+      install: "pnpm install --frozen-lockfile --prod=false",
     },
   },
   {
     file: "yarn.lock",
     pm: {
       name: "yarn",
-      installs: [
-        "yarn install --frozen-lockfile --production=false",
-        "yarn install --production=false",
-      ],
+      install: "yarn install --frozen-lockfile --production=false",
     },
   },
   {
     file: "package-lock.json",
-    pm: {
-      name: "npm",
-      installs: ["npm ci --include=dev", "npm install --include=dev"],
-    },
+    pm: { name: "npm", install: "npm ci --include=dev" },
   },
 ];
 
@@ -68,11 +54,18 @@ export function detectPackageManager(
   }
   if (fs.existsSync(path.join(projectPath, "package.json"))) {
     // No lockfile, so nothing to be frozen to.
-    return { name: "npm", installs: ["npm install --include=dev"] };
+    return { name: "npm", install: "npm install --include=dev" };
   }
   return null;
 }
 
+// pnpm may exist only as a corepack shim that was never enabled; the shell
+// defines `pnpm` through corepack when the command is missing.
+export function shellCommand(command: string): string {
+  if (!command.startsWith("pnpm ")) return command;
+  return `if ! command -v pnpm >/dev/null 2>&1; then pnpm() { COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm "$@"; }; fi; ${command}`;
+}
+
 // What setup commands run under: the server's environment without the
 // settings that make an install skip devDependencies.
 export function setupEnv(

package/lib/worktree-sweep/databases.ts

@@ -22,7 +22,6 @@ import { loadProjectConfig } from "../project-config";
 import { expandHome } from "../project-config/session";
 import {
   LOCAL_HOSTS,
-  MARK,
   SOCKET_DIR,
   pgEnv,
   pgRun,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.680",
+  "version": "0.3.691",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"
@@ -24,29 +24,24 @@
     "tsconfig.json",
     "postcss.config.mjs",
     "tailwind.config.ts",
-    "package-lock.json",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "predev": "node scripts/ensure-native.mjs && node scripts/gen-migrations-index.mjs",
+    "predev": "node scripts/check-native.mjs --rebuild && node scripts/gen-migrations-index.mjs",
     "dev": "AGENTOS_DEV=1 tsx server.ts",
     "dev:task": "tsx scripts/dev-task.ts",
     "dev:stop": "tsx scripts/dev-stop.ts",
     "disk:dry-run": "tsx scripts/disk-dry-run.ts",
     "prebuild": "node scripts/gen-migrations-index.mjs",
     "build": "next build",
-    "prestart": "node scripts/ensure-native.mjs && node scripts/gen-migrations-index.mjs",
+    "prestart": "node scripts/check-native.mjs --rebuild && node scripts/gen-migrations-index.mjs",
     "start": "NODE_ENV=production AGENTOS_SERVER=live node --import tsx server.ts",
     "pretypecheck": "node scripts/gen-migrations-index.mjs",
     "typecheck": "tsc --noEmit",
     "setup": "bash scripts/setup.sh",
     "postinstall": "chmod +x node_modules/node-pty/prebuilds/*/spawn-helper 2>/dev/null || true",
     "prepare": "husky",
-    "tauri": "tauri",
-    "tauri:dev": "tauri dev",
-    "tauri:build": "tauri build",
-    "tauri:build:linux": "docker build -t agentos-linux -f src-tauri/Dockerfile.linux src-tauri && docker run --rm -v $(pwd)/src-tauri/target:/app/target agentos-linux",
     "prelint": "node scripts/gen-migrations-index.mjs",
     "lint": "eslint .",
     "format": "prettier --write .",
@@ -71,7 +66,7 @@
   "author": "Saad Naveed",
   "license": "MIT",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "bugs": {
     "url": "https://github.com/saadnvd1/agent-os/issues"
@@ -155,15 +150,15 @@
     "serwist": "^9.5.7",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.4.0",
+    "unified": "^11.0.5",
     "valtio": "^2.3.0",
     "ws": "^8.19.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.1.18",
-    "@tauri-apps/api": "^2.12.1",
-    "@tauri-apps/cli": "^2.12.1",
-    "@types/better-sqlite3": "^7.6.13",
+    "@types/better-sqlite3": "^9.6.0",
+    "@types/hast": "^3.0.4",
     "@types/jsdom": "^30.0.0",
     "@types/mdast": "^4.0.4",
     "@types/node": "^20.19.27",
@@ -176,7 +171,8 @@
     "husky": "^9.1.7",
     "jsdom": "^30.1.2",
     "prettier": "^3.7.4",
-    "prettier-plugin-tailwindcss": "^0.7.2",
+    "prettier-plugin-tailwindcss": "^0.8.1",
+    "remark-parse": "^11.0.0",
     "sharp": "^0.35.5",
     "tailwindcss": "^4.1.18",
     "tsx": "^4.23.15",
@@ -184,8 +180,5 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.11"
   },
-  "overrides": {
-    "dompurify": "^3.4.16",
-    "postcss-selector-parser": "^7.1.6"
-  }
+  "packageManager": "pnpm@11.28.5+sha512.484563d30b4c2ad27cb48aa94ff2b302dbcebc8ff6bf28816c2589886e146ce7f76f354f3bc1a438e6f5e9768c302aa0a6f7add8232903cd4cf81426cbc14d9e"
 }

package/scripts/check-native.mjs

@@ -0,0 +1,86 @@
+// Proves the native modules work in a node_modules tree: open a SQLite
+// database with better-sqlite3 and spawn a pty with node-pty. Used before a
+// deploy swaps an install in, and by predev/prestart.
+//   node scripts/check-native.mjs [node_modules dir]   (default: this checkout's)
+//   --rebuild  on a Node ABI mismatch, run `pnpm rebuild` once and check again
+import { createRequire } from "module";
+import { execFileSync } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const args = process.argv.slice(2);
+const rebuild = args.includes("--rebuild");
+const modules = path.resolve(
+  args.find((a) => !a.startsWith("--")) ?? path.join(here, "..", "node_modules")
+);
+
+async function sqlite(require) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "aos-native-"));
+  try {
+    const db = require("better-sqlite3")(path.join(dir, "check.db"));
+    db.exec("create table t (v text); insert into t values ('ok')");
+    const row = db.prepare("select v from t").get();
+    db.close();
+    if (row?.v !== "ok") throw new Error("better-sqlite3 read back nothing");
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function pty(require) {
+  return new Promise((resolve, reject) => {
+    const p = require("node-pty").spawn("/bin/sh", ["-c", "echo pty-ok"], {});
+    let out = "";
+    const timer = setTimeout(() => {
+      p.kill();
+      reject(new Error("node-pty: no exit within 10s"));
+    }, 10_000);
+    p.onData((d) => (out += d));
+    p.onExit(({ exitCode }) => {
+      clearTimeout(timer);
+      if (exitCode === 0 && out.includes("pty-ok")) resolve();
+      else reject(new Error(`node-pty: exit ${exitCode}, output ${out}`));
+    });
+  });
+}
+
+async function failures() {
+  const require = createRequire(path.join(modules, "noop.js"));
+  const found = [];
+  for (const [name, run] of [
+    ["better-sqlite3", sqlite],
+    ["node-pty", pty],
+  ]) {
+    try {
+      await run(require);
+    } catch (err) {
+      found.push({ name, message: String(err?.message ?? err) });
+    }
+  }
+  return found;
+}
+
+let bad = await failures();
+if (
+  bad.length &&
+  rebuild &&
+  bad.some((b) => b.message.includes("NODE_MODULE_VERSION"))
+) {
+  const names = bad.map((b) => b.name);
+  console.log(`Rebuilding ${names.join(", ")} for Node ${process.version}...`);
+  execFileSync("pnpm", ["rebuild", ...names], {
+    cwd: path.dirname(modules),
+    stdio: "inherit",
+  });
+  bad = await failures();
+}
+if (bad.length) {
+  for (const b of bad)
+    console.error(`native check failed: ${b.name}: ${b.message}`);
+  process.exit(1);
+}
+console.log(`native modules ok (${modules})`);
+process.exit(0);

package/scripts/code-health/prepass.ts

@@ -142,11 +142,11 @@ async function prepass(args: string[]) {
   const steps: Record<Collector, () => string | void> = {
     deps: () => {
       const prod = JSON.parse(
-        run("npm", ["audit", "--omit=dev", "--json"], root) || "{}"
+        run("pnpm", ["audit", "--prod", "--json"], root) || "{}"
       );
-      const all = JSON.parse(run("npm", ["audit", "--json"], root) || "{}");
+      const all = JSON.parse(run("pnpm", ["audit", "--json"], root) || "{}");
       const outdated = JSON.parse(
-        run("npm", ["outdated", "--json"], root) || "{}"
+        run("pnpm", ["outdated", "--format", "json"], root) || "{}"
       );
       result.deps = {
         prod: summarizeNpmAudit(prod),