[npm-package]： https://www.npmjs.com/package/pastoralist [npm-version-badge]： https://img.shields.io/npm/v/pastoralist.svg [插槽徽章]： https://badge.socket.dev/npm/package/pastoralist/latest [套筒封装]： https://socket.dev/npm/package/pastoralist

Pastoralist 在保持依赖覆盖的同时，确保项目更安全。

它在附录中跟踪每次覆盖：哪些软件包依赖于它，何时 首次被记录，以及是否可以被移除。

覆盖追踪

在已有的 qs 覆盖的情况下，运行 pastoralist 会增加以下记录：

本例使用 express → qs。生成依赖项和日期; 所示版本为灯具输入。

快速启动

用npm或自制软件安装全局CLI：

对于一个项目，安装为开发依赖：

doctor 预览变更。运行pastoralist更新附录。

安装捆绑的特工技能，并附带npx pastoralist init agent-skill。 使用 npx pastoralist --setup-hook 将其添加到 postinstall。

请参见文档中的设置， 配置、工作区、安全性和交互示例。

CLI API

下面的直接命令假设pastoralist可从一个项目获得

Pastoralist

Pastoralist keeps projects more secure while maintaining dependency overrides.

It tracks each override in an appendix: which packages depend on it, when it was first recorded, and whether it can be removed.

Packages you install bring dependencies of their own. Overrides let you choose a different version or replacement package—for example, to address a security issue.

Override Tracking

With an existing qs override, running pastoralist adds this record:

--- package.json
+++ package.json
@@ -5,5 +5,17 @@
   },
   "overrides": {
     "qs": "6.11.2"
+  },
+  "pastoralist": {
+    "appendix": {
+      "[email protected]": {
+        "dependents": {
+          "shepherd-cli": "qs (required by express)"
+        },
+        "ledger": {
+          "addedDate": "2026-10-16"
+        }
+      }
+    }
   }
 }

This example uses express → qs. The dependents and date are generated; the versions shown are fixture inputs.

Quick Start

Install the global CLI with npm or Homebrew:

npm install --global pastoralist
# or
brew install yowainwright/tap/pastoralist

For a project, install it as a dev dependency:

npm install pastoralist --save-dev
npx pastoralist doctor
npx pastoralist

doctor previews changes. Running pastoralist updates the appendix.

Install the bundled agent skill with npx pastoralist init agent-skill. Use npx pastoralist --setup-hook to add it to postinstall.

See the docs for setup, configuration, workspaces, security, and interactive examples.

CLI API

The direct commands below assume pastoralist is available from a project script, global npm install, or Homebrew install. Use npx pastoralist ... for one-off project setup.

pastoralist

Type: command

Updates the target package manifest’s override appendix. It reads npm overrides, pnpm pnpm.overrides or pnpm-workspace.yaml (pnpm 11+),