pnpm, Package Management & Windows Permissions Understand dependency installation, user-profile tooling, local executables, build-script approvals, and why permission errors are filesystem evidence.
Book 3 · Package management Course baseline: September 17, 2026 · Windows-first · Project-driven · Production-oriented
Contents 1. Package-manager mental model 6. Core pnpm commands
Phase 01 | Page 2 of 6
pnpm is the package manager for this course A package manager resolves dependencies, downloads packages, records exact versions, creates executable shims, and runs project scripts. pnpm adds a content-addressable store and workspace features that make it a strong fit for the monorepo we will build in Phase 02.
Figure 1 - Package installation lifecycle - A package manager is performing dependency graph and filesystem work, not merely downloading ZIP files.
Why pnpm 12.4.2?
Phase 00 froze the course baseline. pnpm 12.4.2 was released September 15, 2026 and includes current security and Windows installation fixes. We keep that exact version throughout the generated course unless an explicit migration is approved.
Phase 01 | Page 3 of 6
pnpm -v
Get-Command pnpm -ErrorAction SilentlyContinue
npm config get prefixOn a machine where the user does not have administrator rights, avoid depending on C:\Program Files\nodejs for package-manager shims.
npm config set prefix "$env:APPDATA\npm"
npm install -g pnpm@12.4.2
$env:Path += ";$env:APPDATA\npm"
pnpm -vThe temporary PATH append makes the current shell see the user-profile npm bin directory. If your persistent user PATH does not already contain it, add that directory through Windows user environment settings or an approved PowerShell profile mechanism.
Global npm packages are written under the current user profile instead of a protected Program Files directory. The principle is least privilege: use administrator rights only when the operation actually requires them.
On some Windows installations, corepack enable attempts to create or update shims beside Node in C:\Program Files\nodejs\ . A standard user may receive EPERM: operation not permitted . That does not mean pnpm is broken; it means the requested filesystem location is protected.
corepack enable → tries protected Node directory →Windows access check → EPERM
Phase 01 | Page 4 of 6
pnpm commands you should understand nowpnpm -v Verify the package-manager executable selected by PATH.pnpm install Resolve/install dependencies using the lockfile and manifest.pnpm add package Add a runtime dependency to the current package.pnpm add -D package Add a development-only dependency.pnpm remove package Remove a dependency cleanly.pnpm exec tool Run a locally installed project executable.pnpm run script Run a script defined in package.json.Later, Prisma is intentionally local. We will run pnpm exec prisma so the project controls the exact Prisma version. This is a general professional principle: project tools should usually be versioned with the project.
Modern pnpm may refuse unapproved dependency build scripts and report ERR_PNPM_IGNORED_BUILDS . Treat that as a security signal, not an invitation to disable protection globally.
pnpm approve-buildsApprove only packages the project genuinely requires, and understand why their install scripts execute.
□ pnpm -v returns 12.4.2. □ You know where the pnpm command is resolved from. □ You can explain local vs global package tools. □ You can explain why pnpm exec improves reproducibility. □ You understand what an ignored build script warning is protecting.
Phase 01 | Page 5 of 6
Phase 01 · Book 3 · Package management
Phase 01 | Page 6 of 6
Authorization decides what an authenticated identity may do to a specific resource. UI hiding is never a substitute for server-side enforcement.
Restate the goal of “pnpm Package Management and Permissions” as one observable behavior. Write the success signal before touching code.
Trace the boundary map: trusted identity → requested action → resource scope → policy decision → allow/deny. Mark the one boundary this lesson changes.
Inspect the current repository state and record the exact files, route, table, or runtime involved. Avoid creating an abstraction before you can name the existing owner.
Implement the smallest vertical slice. Add one coherent change, run the narrowest verification command, and read the output before continuing.
Connect the slice to TaskFlow’s phase artifact: A verified toolchain report showing shell, Git, Node, Corepack/pnpm, editor, PATH, ports, and diagnostic commands.. Verify behavior from the outside as a user or API client would.
Create one controlled failure that is safe to reproduce. Predict the symptom first, capture evidence, locate the earliest broken boundary, then fix only that cause.
Close the reference and rebuild or explain the core change from memory. Record what you would monitor or test before trusting the same change in production.
const canEdit =
user.role === "ADMIN" ||
(user.role === "MEMBER" && task.ownerId === user.id);
if (!canEdit) throw new ForbiddenException();Do not copy this as a finished answer. Predict what each boundary does, type the smallest useful slice, run it, then compare the result with your prediction.
Trace verified identity, role, resource owner/workspace, and policy inputs separately.
Add server-side resource authorization; UI visibility is only experience, never enforcement.
Without copying the final source, create a second small scenario that applies “pnpm Package Management and Permissions” to a different TaskFlow resource or input. Write the acceptance criteria first, implement it, and provide the evidence that each criterion is satisfied.
Install the course Node line with a version manager and prove which executable is active.
Use the smallest change that demonstrates this lesson. Stop after it works and capture evidence.Different shells resolving different PATH values
Predict the symptom before causing the failure. Then locate the earliest boundary where reality diverges from expectation.Why does this responsibility live here, what input does it trust, what output proves success, and what would go wrong if another layer owned it?
If your explanation is vague, repeat the boundary trace before moving on.Close the reference. Reproduce the core idea from memory or explain the exact request/data flow aloud. Then check your diff or notes for accidental shortcuts that bypass validation, authorization, error handling, or verification earned in earlier phases.