Pm Guard

pm-guard — Never accidentally `npm install` in a pnpm project again

[ English | 日本語 ]

A [Claude Code](https://docs.anthropic.com/en/docs/claude-code) plugin that prevents Claude from using the wrong package manager.

What It Does

• Guards npm, yarn, pnpm, bun, and deno (including npx, pnpx, bunx)
• Auto-detects the project's package manager from env var, package.json, or lockfiles
• Blocks disallowed commands before execution via PreToolUse hook
• Zero dependencies — pure bash, no jq or node required

Quick Start

1. Add the marketplace:

   /plugin marketplace add udonc/pm-guard

2. Install the plugin:

   /plugin install pm-guard@pm-guard

3. That's it. pm-guard auto-detects your package manager from lockfiles or `package.json` — no configuration needed.

If Claude tries to use the wrong package manager, the command is blocked:

This project uses pnpm. Use pnpm commands instead of npm.

Configuration

The allowed package manager is detected with the following priority:

1. `PM_GUARD_ALLOWED` environment variable (highest priority)

PM_GUARD_ALLOWED=pnpm claude

2. `packageManager` field in `package.json`

{
  "packageManager": "pnpm@9.15.4"
}

The version suffix is ignored — only the package manager name is used.

3. Lockfile detection (lowest priority)

Lockfile	Detected PM
pnpm-lock.yaml	pnpm
yarn.lock	yarn
package-lock.json	npm
bun.lock / bun.lockb	bun
deno.lock	deno

How It Works

pm-guard registers a `PreToolUse` hook on the `Bash` tool. When Claude attempts to run a shell command, the hook:

1. Extracts the command from the tool input JSON
2. Determines the allowed package manager (see Configuration)
3. Strips content inside quotes (both single and double) so that strings like grep "npm" package.json don't trigger