zfinix/aster/package-managers

Package managers

1. The lockfile picks the manager. bun.lock/bun.lockb means bun,

pnpm-lock.yaml means pnpm, yarn.lock means yarn, package-lock.json means npm. Never mix: running npm in a bun repo creates a second lockfile and a second dependency tree.

1. Run from the directory that owns the lockfile, not the repo root of a

monorepo.

1. Scripts go through the owner. bun run build, pnpm run test;

one-offs with bunx tool or pnpm dlx tool, never bare npx in a non-npm repo.

1. A failed install is not a reason to switch managers. If bun install

fails, npm install in the same repo fails for the same underlying reason and leaves a mess behind. Diagnose the actual error instead.

1. Permission errors during installs are usually the sandbox. Writes are

allowed in the repository, temp directories, and package caches (~/.npm, ~/.bun, ~/.cargo). An error naming another path means the sandbox blocked it; report the path instead of retrying.

1. Offline or turbo mode blocks the network. Installs need the network;

say that plainly instead of retrying the install.