Using packages

add

genpm add @core/billing            # latest
genpm add @core/auth@^1.2          # semver range
genpm add @core/db --dest packages/db
genpm add @core/billing --dry-run  # show the plan, write nothing

GenPM asks three separate questions: inject the code, add MCP servers (showing the full command), and run the package-manager command for npm dependencies. --yes only answers the first one; use --mcp and --install-deps for the others.

If the destination exists and is not empty, add fails with E_DEST_CONFLICT. --force moves the old content to .genpm/backup/<timestamp>/ first.

search and info

genpm search stripe
genpm info @core/billing          # manifest, deps, MCP, env and full AI rules
genpm info @core/billing --rules  # only the rules

list and remove

genpm list
genpm remove @core/auth

list compares every injected file with its recorded SHA-256 (drift). remove refuses to delete code you changed (E_DRIFT): use --keep-code to keep it or --force to delete it anyway. A package required by another one cannot be removed first (E_REQUIRED_BY).

outdated and audit

genpm outdated
genpm audit   # add it to your CI as: npx genpm audit

audit verifies file integrity, the registry signature of every lock entry, security advisories, yanked versions and quarantines. It exits with code 6 on high or critical findings.

JSON output

Every command accepts --json (one line, English, no prompts). Without a TTY, any unanswered question fails with E_CONFIRM_REQUIRED (exit 2).