v2.2.1: Install path self-healing and cold-install speedups

A patch release focused on the install path: several fixes make aube install recover from stale caches and links on its own, node-gyp shims stay correct after dependency builds, peer resolution more closely matches pnpm, and cold/repeat installs on large repos get meaningfully faster.

Fixed

• Self-heal stale node-gyp caches (#1407 by @jdx) — The node-gyp bootstrap cache no longer treats leftover .bin wrappers as healthy after their virtual-store targets are gone. A cache hit is now accepted only when the decoded wrapper's target still exists, so deleting the global virtual store triggers a clean re-bootstrap instead of returning a broken node-gyp path.
• Self-heal stale links on non-workspace installs (#1406 by @jdx) — A non-workspace aube install could fail repeatedly with failed to link node_modules when a node_modules/.aube/<dep> entry still resolved but pointed at an outdated virtual-store subdir. The fetch phase now verifies the resolved target against the subdir the current graph expects, so a mismatched entry is re-fetched and the install recovers on the next run.
• Refresh bin shims after dependency builds (#1404 by @jdx) — Approved dependency lifecycle scripts can change what a bin actually is (for example, pnpm 12's preinstall swaps a text placeholder for a native executable). Aube now relinks node_modules/.bin shims after dependency builds and side-effects-cache restores, while preserving lifecycle-created replacements, so shims reflect the final binaries before root scripts or user commands run.
• Match pnpm importer peer semantics (#1399 by @jdx) — With autoInstallPeers, only an importer's own required peers (respecting peerDependenciesMeta.optional) are seeded as direct dependencies and linked at the workspace root; peers required by transitive dependencies stay in their peer context instead of getting synthetic importer rows and top-level links. Frozen-lockfile drift checks accept pnpm-generated importer peers and rewrite legacy Aube hoists, and aube check now reports a new dangling issue (human-readable and JSON) when an importer's virtual-store cell is missing.

Performance

• Faster cold installs under the default trust policy (#1403 by @jdx) — With the default trustPolicy=no-downgrade, lockfile validation no longer downloads and re-serializes full packuments for every locked package. It now fetches one compact trust history per registry name, decodes only what the check reads, and caches it under trust-history-v1/. On the benchmark fixture this cut on-disk cache from 739 MB to 381 MB and shaved the resolve phase from 6.1s to 5.4s. Online installs can also skip re-validation via a lockfile-content stamp when validation would have been a cache hit anyway.
• Cut freshness and repeat-install overhead on large repos (#1400 by @jdx) — Several structural costs behind slow no-op/repeat installs on big monorepos were removed: parallelized virtual-store link scans, a single parse of state.json in finalize, an early exit in project-link detection, a (size, mtime) fast path for the root lockfile on every aube run/exec/test startup, and compact JSON for state.json/fresh.json. Measured at −2.33% install instructions with no regressions.

Full Changelog: v2.2.0...v2.2.1

💚 Sponsor aube

aube is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise. Work on aube is funded by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at jdx.dev. Individual and company sponsorships are what keep the project fast, free, and independent.