In macOS it does not delete symbolic links in global installations and does not respect XDG

[kallookoo]

Hello,

I have verified that symbolic links are not deleted correctly after deleting a global package and another thing that I have detected is that it does not respect XDG folders. I understand that XDG does not come by default in macOS, but many commands respect it and it would be appreciated if it also supported it.

Global Information:

sergio in ~ 
> aube --version
1.37.0 macos-arm64 (2026-07-31)
sergio in ~ 
> fish --version 
fish, versión 4.8.1
sergio in ~ 
> sw_vers 
ProductName:		macOS
ProductVersion:		26.5.2
BuildVersion:		25F84

Testing of a global installation:

sergio in ~ 
> aube add -g @earendil-works/pi-coding-agent
Resolving @earendil-works/pi-coding-agent@latest...
  + @earendil-works/pi-coding-agent@0.83.0 (specifier: 0.83.0)
Updated package.json
aube 1.37.0 by jdx.dev  [==============================================================================================================]  127/127 pkgs
1 transitive package has deprecation warnings. Run `aube deprecations --transitive` to see them.
dependencies:
+ @earendil-works/pi-coding-agent@0.83.0

 WARN aube::commands::install::unreviewed_builds: ignored build scripts for 2 package(s): @google/genai@1.52.0, protobufjs@7.6.5. Run `aube approve-builds` to review and enable them, or set `strictDepBuilds=true` to fail installs that have unreviewed builds. code="WARN_AUBE_IGNORED_BUILD_SCRIPTS" count=2 packages=["@google/genai@1.52.0", "protobufjs@7.6.5"]
Linked 1 bin into /Users/sergio/Library/pnpm
sergio in ~ 
> which -a pi                                                                                                                                 took 4s 
/Users/sergio/Library/pnpm/pi
sergio in ~ 
> aube remove -g @earendil-works/pi-coding-agent
Removed global @earendil-works/pi-coding-agent
sergio in ~ 
> which -a pi
sergio in ~ 
x la $(aube bin -g)
total 0
drwxr-xr-x  2 sergio  staff    64B  4 ago.  00:15 global-aube/
lrwxr-xr-x  1 sergio  staff   112B  4 ago.  00:14 pi@ -> /Users/sergio/Library/pnpm/global-aube/9293-19fc9b16d31/node_modules/@earendil-works/pi-coding-agent/dist/cli.js
sergio in ~ 
> 

Several outputs related to XDG:

sergio in ~ 
> env | grep AUBE
AUBE_SHIM_DIR=/Users/sergio/.local/share/aube/shims
sergio in ~ 
> aube bin -g
/Users/sergio/Library/pnpm
sergio in ~ 
> env | grep XDG
XDG_CACHE_HOME=/Users/sergio/.cache
XDG_STATE_HOME=/Users/sergio/.local/state
XDG_DATA_HOME=/Users/sergio/.local/share
XDG_RUNTIME_DIR=/var/folders/sn/3f415qts51jd75kps6d_dft80000gn/T/
XDG_CONFIG_HOME=/Users/sergio/.config
XDG_BIN_DIR=/Users/sergio/.local/bin

[jdx]

Thanks for the detailed report — both halves reproduce, and they turned out to be independent problems.

The dangling symlink is a real bug, and not macOS-specific

Fix is up in #1232.

It reproduces on Linux too, and it affects every global package rather than just this one. unlink_bins decided whether a bin belonged to the install being removed by canonicalizing the symlink's target and requiring it to sit under the install dir. With the global virtual store enabled — the default outside CI — node_modules/<pkg> resolves through .aube/<dep_path> into <cacheDir>/virtual-store/<dep>-<hash>:

bin target:  <install>/node_modules/@earendil-works/pi-coding-agent/dist/cli.js
canonical:   ~/.cache/aube/virtual-store/…/node_modules/…/dist/cli.js

That's never under the install dir, so every global bin was read as "owned by some later install" and left alone — then dangled once remove -g deleted the install. Fixed by checking the target textually first, which is how the sibling code path for non-symlink shims already worked.

Our own test missed it because it asserted with [ -f ], and a dangling symlink fails -f — so the leak looked like a pass. That assertion now also checks [ ! -L ].

The fix isn't retroactive — cleanup reads the install directory's package.json to learn which bin names to remove, and that directory is already gone in your case. So the leftover needs one manual removal:

rm ~/Library/pnpm/pi

You're right about XDG, and it's narrower than it looks

Your XDG_DATA_HOME / XDG_CACHE_HOME are honored on macOS for the content store, the packument cache, the shims dir, and Node runtimes. The global directory was the single exception: it hardcoded ~/Library/pnpm and never looked at XDG, which is why aube bin -g was the one path that ignored your environment.

That's deliberate pnpm parity (pnpm special-cases macOS the same way), but it's inconsistent with the rest of aube, so we're planning to stop using pnpm's directories for aube's own data entirely — global installs would move under $XDG_DATA_HOME/aube alongside store/ and nodejs/. The change is drafted in #1231, though it's breaking and would have to wait for a v2, so there's no timeline yet.

Until then you can get the layout you want today:

set -gx AUBE_HOME $XDG_DATA_HOME/aube/bin

Then add that to fish_user_paths and re-run aube add -g <pkg> for anything you want moved. AUBE_HOME takes precedence over the platform default and will keep working after the v2 change.

One more thing worth knowing: nothing currently warns when the global bin dir isn't on $PATH, so a global install can report success while the command stays unreachable. That warning is in #1231.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5; version: unavailable.