Nub Files

Package-manager compatibility fixes — pnpm 11 monorepo installs, bun.lock byte-identity, and a vendored aube engine sync to v1.23.0 — plus a transpile-cache correctness fix.

[!IMPORTANT] Transpile cache re-warms once after upgrading. The transpile cache key now includes a compile-time build-id (#85). This is a schema bump, so the first run after upgrading recompiles and re-warms the cache. It is a one-time, expected step — subsequent runs hit the cache as before.

[!IMPORTANT] The malicious-package check on exact pins is now version-aware. With the aube v1.23.0 sync (#84), installing an exact version (nub add <pkg>@<version>) runs a version-aware OSV query instead of a name-only one. An exact pin of a version known to be malicious is now caught at add time.

Package manager

aube engine v1.23.0

The vendored package-manager engine was synced to upstream v1.23.0 (#84), bringing:

• Version-aware OSV malicious-package check on exact pins (see the callout above).
• NODE_EXTRA_CA_CERTS support in the registry client.
• outdated now includes global packages.
• audit output aligned to pnpm's shape.

Runtime

• Transpile-cache build-id correctness. A compile-time build-id is now part of the transpile cache key, so an upgrade no longer risks serving stale transpiled output (#85). See the callout above for the one-time re-warm.
• nub node with no arguments prints the current status, then the help text (#73).

Documentation

• README wording pass — file-runner intro, Node provisioning section, and feature-list copy (6a7d874d, 22dd7168).
• Runtime docs now nest --node and NODE_COMPAT under a Compatibility-mode section and document NODE_COMPAT (14430a4e, ea1305c6).
• setup-nub now leads with drop-in compatibility and reflects eager Node provisioning and the global PATH (55b54db1, f028b1e2).
• Version-pin examples track the latest Node version dynamically (e7ec030c).

Testing & internals

• Internal: restructured how the vendored PM engine is tracked (#81).
• Added a command×flag conformance harness covering the full CLI surface, differential against the reference package manager (#75).
• Added a differential registry/auth conformance harness (#80).
• Added a cold-CAS install benchmark harness (#86).
• Isolated HOME in the aube-registry config tests so a host ~/.npmrc can't fail them (#83).
• Added ci-watch.ts, a robust CI poller (29125cf3).

Commits in this release

• docs(readme): content update (2f655a3e)
• docs(runtime): lead with augmentation value; fix Node-resolution framing; document NODE_COMPAT (ea1305c6)
• docs: capitalize 'Nub' in prose per naming rule; fix setup-nub ^0.0→^0.1.0 semver example; add naming rule to PROSE.md (216bc209)
• docs(run): lead with pnpm-run compatibility; inline flag-differences note (a8590b99)
• docs(setup-nub): lead with drop-in compatibility; reflect v0.2.0 eager Node provisioning (f028b1e2)
• docs: editorial polish on run + setup-nub pages (10681b49)
• rename flag-injected→unflagged terminology; add copy-model rule to AGENTS.md (d79274c9)
• docs(readme): content update (8bbc4619)
• scripts: add ci-watch.ts robust CI poller + ci-watch skill (29125cf3)
• Update readme (84997489)
• Add icon (793ef027)
• node: bare nub node prints status then help (#73) (693207f6)
• docs: add L1_AGENTS.md — operating manual for dispatched agents (no name field, active-collect, thread-ownership, surface-don't-guess, nested pattern) (efaf23da)
• fix(pm): bump aube pin to fix spurious GVS reinstall in workspace members (#74) (68901ddc)
• Update readme (efdf54fe)
• tests: add command×flag conformance harness (full CLI surface, differential vs reference PM) (#75) (c769c690)
• Update readme (7ef49950)
• fix(agent): remove embedded-engine brand leak from agent skill copy (#76) (b51149b2)
• fix(pm): clear conformance-sweep bugs (brand leak, lockfile-name hint, pm which bun) (#77) (a71bfd6c)
• test(aube-bats): skip stale workspace-marker assertion after [#77] brand fix (#79) (2bc89cee)
• docs(setup-nub): lead with drop-in compatibility; reflect eager Node provisioning + global-PATH (v0.4.0) (55b54db1)
• fray: merge-cascade flips the thread to done on merge (fix board drift) (ca2f9fc0)
• docs(setup-nub): use a concrete node-version (the {{NODE_VERSION}} resolver isn't on main) (4154e057)
• docs(readme): wording pass — file-runner intro, Node provisioning section, feature-list copy (6a7d874d)
• docs(runtime): nest --node and NODE_COMPAT under a Compatibility mode section (14430a4e)
• docs(readme): fix extension-list punctuation/backticks + neeed→needed typo (22dd7168)
• fix(pm): support pnpm 11 monorepo installs (workspace link: peers, optional auto-installed peers) (#78) (24ee8a4f)
• test(registry): add differential registry/auth conformance harness (#80) (e32f82a9)
• build(pm): vendor aube as plain in-tree files, drop the git submodule (Pattern B) (#81) (779422cb)
• fix(pm): bun.lock writer byte-identity — multi-line named catalogs + collapse empty packages (#82) (f715c6c1)
• test(pm): isolate HOME in aube-registry config tests so a host ~/.npmrc can't fail them (#83) (026d18af)
• build(pm): sync vendored aube to upstream v1.23.0 (#84) (1427bae8)
• docs: track the latest Node version dynamically in version-pin examples (e7ec030c)
• test(bench): add cold-CAS install benchmark harness (#86) (3fc07cb2)
• perf(native): stamp transpile-cache build-id at compile time (#85) (777dad93)
• v0.1.12 (2b08d94c)

Full Changelog: https://github.com/nubjs/nub/compare/v0.1.11...v0.1.12