A package-manager configuration batch: an asymmetric global config model, pnpm 11 project-write alignment, and native implementations of the npm-only verbs.
Asymmetric global config
Two related config-home changes shipped together.
Global reads are now unconditional. Nub previously read pnpm's global config.yaml and auth.ini only when the current directory was a pnpm project — a bug that applied a project-incumbent gate to global files that have nothing to do with the project. Global and project-scoped reads are now decoupled.
Global writes go to neutral files only. When writing with --global or nub global config, Nub never touches a PM-branded global file — auth keys and scalar settings go to ~/.npmrc, which every tool reads, and never to pnpm's config.yaml or auth.ini.
Project-local writes align with pnpm 11. The write router mirrors pnpm's own split: auth and npm-shared keys go to .npmrc; non-shared scalar keys go to pnpm-workspace.yaml under a pnpm incumbent, and to the project .npmrc under a Nub-identity or npm/yarn/bun project. Map settings — overrides, allowBuilds, catalogs — are refused with a pointer to pnpm-workspace.yaml. (#35)
Native npm-only verbs
The verbs below previously returned an npm-only error. They are now implemented natively — no shell-out — each hitting the registry directly with the same .npmrc auth and registry client the installer already uses, or editing the local package.json. (#36)
| Verb | What it does |
|---|---|
search <q> | Registry search, pnpm-shape output plus --json |
whoami | Whoami with .npmrc bearer auth |
owner ls/add/rm | Collaborators read plus maintainers write |
token list/create/revoke | Token CRUD |
pkg get/set/delete/fix | Local package.json property-path edits |
set-script <name> <cmd> | Script sugar over the same writer |
The full release notes list every change in this release.
Get started
Or paste this "Get Started" prompt into an agent. It will install Nub and explain how it can be used in your project. (It won't make any changes without permission.)