v1.8.0: Stable error codes, smarter run/dlx, and a new install progress UI

A polish-and-plumbing release: install progress gets a from-scratch redesign, errors and warnings now carry stable identifiers (with bespoke exit codes and dep-chain context), aube run / aube dlx prefer locally-installed binaries, and a handful of workspace-from-subpackage and aube add ergonomics get fixed.

Added

• Redesigned install progress UI (#501 by @jdx) — fixed 15-char bar on the left, stats on the right, phase-aware label (resolving / fetching / linking), ETA, transfer rate, and an estimated install size derived from the resolve stream:

  aube 1.8.0 by en.dev
  █████░░░░░░░░░░ 23/142 pkgs · 4.2 MB / ~13.8 MB · 1.4 MB/s · ETA 5s
  ███████████████ 1230/1230 pkgs · linking
  ✓ resolved 1230 · reused 98 · downloaded 1132 (54.6 MB) in 6.8s
  

  Installs that finish before the first 2s heartbeat now print a single self-identifying summary line (✓ installed 5 packages in 423ms) instead of a partial bar. Also fixes two real bookkeeping bugs (a 2/1 packages overflow on platform-mismatched non-optional deps, and the "stuck at 90%" undercount caused by filter_graph dropping packages after the denominator was inflated).

• Local bins for aube run and aube dlx (#502 by @jdx) — aube run <name> falls back to node_modules/.bin/<name> when no package.json script matches, and aube dlx / aubx will execute an already-installed local binary instead of doing a throwaway install. Pass -p / --package (or a versioned spec) to force the install path.

• Stable error and warning codes (#492 by @jdx) — every error and warning aube emits now carries an ERR_AUBE_* or WARN_AUBE_* identifier in a structured field, so CI scripts and ndjson consumers can branch on the code instead of substring-matching English messages. A curated subset maps to bespoke Unix exit codes (10–99 in 10-wide ranges by category) so shells can react to specific failures without parsing stderr — e.g. aube install --frozen-lockfile in an empty dir exits with 10 (ERR_AUBE_NO_LOCKFILE). Post-resolver errors that mention a specific package now also include the dependency chain back to the importer (chain: a@1 > b@2 > leaf@3) so a tarball-integrity or fetch failure tells you why your install pulled that transitive dep. The full code list lives at docs/error-codes.md.

Fixed

• aube why / list / query from a workspace subpackage (#504 by @jdx) — these commands resolved cwd via the nearest package.json, so running them inside packages/foo/ errored with No lockfile found. Run aube install first. even though the workspace lockfile sat one level up. They now walk up to the workspace root when one is present.

• Workspace lifecycle scripts and pnpm-lock npm aliases (#500 by @jdx) — recursive workspace installs now run preinstall/install/postinstall/prepare for each linked workspace importer in dependency order (not just the root), and the build-script policy merges pnpm.allowBuilds / onlyBuiltDependencies / neverBuiltDependencies across all participating manifests so a member can approve its own dep's builds. pnpm-lock.yaml now writes npm aliases in pnpm's native <real>@<version> encoding instead of leaking aube's internal aliasOf field.

• aube add auto-detects local paths (#499 by @jdx) — aube add /path/to/lib, ./lib, ~/lib, file:./lib, and link:./lib no longer fall through to the registry path with a confusing HTTP 405 Method Not Allowed. Bare paths default to link: for directories and file: for tarballs (pnpm parity); explicit prefixes are preserved. Tarball-suffix paths emit a clear "not yet supported in aube add" hint instead of a 405.

Changed

• Per-command --help is bucketed (#505 by @jdx) — --frozen-lockfile / --prefer-frozen-lockfile, --registry + --fetch-*, and --disable/--enable-global-virtual-store moved off the global flag set into per-command groups under Lockfile / Network / Virtual store headings, and now appear only on commands that consume them. Seven pnpm-compat no-op flags (--workspace-packages, --ignore-workspace, --include-workspace-root, --aggregate-output, --stream, --use-stderr, --yes) are still parsed but hidden from --help. Pre-subcommand placement still works (aube --frozen-lockfile install, aube --registry=URL install) via an argv pre-pass.

  One caveat: implicit-script invocations like aube --frozen-lockfile dev (where dev is a package.json script) no longer apply the flag — write aube run --frozen-lockfile dev instead.

Full Changelog: v1.7.0...v1.8.0

💚 Sponsor aube

aube is part of en.dev — an independent developer-tooling studio run by @jdx, also behind mise. Work on aube is funded entirely by sponsors.

If aube is saving your team install time or CI minutes, please consider sponsoring at en.dev. Individual and company sponsorships are what keep the project fast, free, and independent.