chore: switch from npm to pnpm (0.2.4)

.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "claude-code-ai-observability",
       "description": "Realtime Sentry traces with per-turn tokens, cost, subagent and error instrumentation, and rich auto-tagging (session / git / host). Forked from sergical/claude-code-sentry-monitor (MIT).",
-      "version": "0.2.3",
+      "version": "0.2.4",
       "author": {
         "name": "Joshkop"
       },

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-code-ai-observability",
   "description": "Comprehensive AI Agent Observability plugin for Claude Code — realtime Sentry traces with per-turn tokens, cost, subagent and error instrumentation, and rich auto-tagging (session / git / host). Forked from sergical/claude-code-sentry-monitor (MIT).",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "author": {
     "name": "Joshkop"
   },

.github/workflows/ci.yml

@@ -10,18 +10,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.9.0
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
-      - run: npm ci
-      - run: npx tsc --noEmit
-      - run: npm test
+          cache: "pnpm"
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec tsc --noEmit
+      - run: pnpm test
       - name: build
-        run: npm run build
+        run: pnpm run build
       - name: assert scripts/*.js is in sync with src/
         run: |
           if ! git diff --quiet --exit-code -- 'scripts/*.js'; then
-            echo "::error::scripts/*.js is out of sync with src/. Run 'npm run build' and commit the result."
+            echo "::error::scripts/*.js is out of sync with src/. Run 'pnpm run build' and commit the result."
             git diff -- 'scripts/*.js'
             exit 1
           fi

AGENTS.md

@@ -30,15 +30,15 @@ Claude Code plugin that instruments sessions as realtime Sentry traces. Each use
 ## For AI Agents
 
 ### Working In This Directory
-- Source of truth is `src/*.ts`. The compiled `scripts/*.js` siblings are build artifacts produced by `npm run build` (`tsc -p tsconfig.json`). Do **not** hand-edit JS in `scripts/` — edit the matching `.ts` and rebuild.
-- `scripts/hook.sh`, `scripts/doctor.sh`, `scripts/smoke-test.sh`, `scripts/package.json`, `scripts/package-lock.json` are NOT generated — they are real source files committed in `scripts/`.
+- Source of truth is `src/*.ts`. The compiled `scripts/*.js` siblings are build artifacts produced by `pnpm run build` (`tsc -p tsconfig.json`). Do **not** hand-edit JS in `scripts/` — edit the matching `.ts` and rebuild.
+- `scripts/hook.sh`, `scripts/doctor.sh`, `scripts/smoke-test.sh`, `scripts/package.json`, `scripts/pnpm-lock.yaml` are NOT generated — they are real source files committed in `scripts/`.
 - The plugin is loaded from `${CLAUDE_PLUGIN_ROOT}` at session start; restart Claude Code after upgrades.
 
 ### Testing Requirements
-- `npm test` — vitest run (no watch).
-- `npm run build` — typecheck + emit JS.
-- `npm run smoke` — end-to-end smoke test against a running collector.
-- `npm run ci` — typecheck (`tsc --noEmit`) + tests + smoke. Run before release.
+- `pnpm test` — vitest run (no watch).
+- `pnpm run build` — typecheck + emit JS.
+- `pnpm run smoke` — end-to-end smoke test against a running collector.
+- `pnpm run ci` — typecheck (`tsc --noEmit`) + tests + smoke. Run before release.
 
 ### Common Patterns
 - ES modules (`"type": "module"`); imports use `.js` extensions even from `.ts` files.

CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.2.4] - 2026-05-20
+
+### Changed
+
+- **Switched dev workflow and CI from npm to pnpm.** Motivated by recent npm supply-chain incidents; pnpm's content-addressable store and stricter dependency isolation reduce blast radius.
+  - Root and `scripts/` now use `pnpm-lock.yaml` (no `package-lock.json`).
+  - `packageManager: "pnpm@10.9.0"` field added to both `package.json` files so Corepack auto-resolves the right pnpm version on user machines.
+  - CI workflow (`.github/workflows/ci.yml`) installs pnpm via `pnpm/action-setup@v4`, uses `pnpm install --frozen-lockfile`, and runs `pnpm run` for build/test/smoke.
+  - Plugin `postinstall` script uses `corepack pnpm install --prod --frozen-lockfile`, so end-users installing via Claude Code's `/plugin install` get a deterministic pnpm-backed dep tree without needing pnpm on their PATH (Corepack is bundled with Node ≥ 16.13).
+  - README and AGENTS.md updated to reference `pnpm` instead of `npm`.
+
+No behavior change to emitted spans, runtime hooks, or any plugin attribute. This is a build/distribution-system change only.
+
 ## [0.2.3] - 2026-05-20
 
 ### Added

README.md

@@ -44,7 +44,7 @@ The bundled setup skill walks you through it: paste your Sentry DSN (Sentry →
 ```bash
 git clone https://github.com/Joshkop/claude-code-ai-observability
 cd claude-code-ai-observability
-npm install
+pnpm install
 ```
 
 Then register the hooks in your Claude Code settings (`.claude/settings.json`):