build: migrate from aube to pnpm

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  # pnpm project (Dependabot detects pnpm from pnpm-lock.yaml and the
+  # packageManager field). The 7-day cooldown (zizmor's minimum) also exceeds
+  # pnpm-workspace.yaml's 1-day minimumReleaseAge, so version updates never
+  # propose a release pnpm would refuse to resolve.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore(deps)
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: chore(ci)

.github/workflows/ci.yml

@@ -186,8 +186,8 @@ jobs:
         uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
           # The macOS job does not run workflow linting or Communique, so avoid
-          # installing release-only tools. It still needs aube for bootstrap-ci.
-          install_args: --locked node python aube
+          # installing release-only tools. It still needs pnpm for bootstrap-ci.
+          install_args: --locked node python npm:pnpm
 
       - name: Install CI dependencies
         run: mise run bootstrap-ci

.github/workflows/release.yml

@@ -96,9 +96,9 @@ jobs:
         run: mise run bootstrap-ci
 
       # bootstrap-ci intentionally skips browser downloads so jobs that do not
-      # need Chromium can stay on deterministic `npm ci`. This release workflow
-      # runs the full Linux quality bar, so install Chromium explicitly just as
-      # `.github/workflows/ci.yml` does.
+      # need Chromium can stay on a deterministic frozen `pnpm install`. This
+      # release workflow runs the full Linux quality bar, so install Chromium
+      # explicitly just as `.github/workflows/ci.yml` does.
       - name: Install Playwright Chromium
         run: npx playwright install chromium
 

.mux/init

@@ -31,7 +31,8 @@ if [ -f "$_mux_mise_config" ]; then
 fi
 
 "$_mux_mise_bin" install
-"$_mux_mise_bin" exec -- aube exec playwright install chromium
+"$_mux_mise_bin" exec -- pnpm install
+"$_mux_mise_bin" exec -- pnpm exec playwright install chromium
 
 unset _mux_mise_bin
 unset _mux_mise_config

.oxfmtrc.json

@@ -11,7 +11,7 @@
     "dist",
     "node_modules",
     "package-lock.json",
-    "aube-lock.yaml",
+    "pnpm-lock.yaml",
     "dogfood/agent-uses-agent-tty/README.md",
     "dogfood/agent-uses-agent-tty/promoted-run-summary.md",
     "dogfood/agent-uses-agent-tty/manifest.json",

AGENTS.md

@@ -80,17 +80,18 @@ Important implications:
 
 # Essential commands
 
-Preferred setup uses `mise`; fall back to direct `aube` only when necessary.
+Preferred setup uses `mise`; fall back to direct `pnpm` only when necessary.
 
 ```sh
 mise install
 mise run bootstrap
 ```
 
-If `mise` is unavailable but `aube` is available:
+If `mise` is unavailable but `pnpm` is available:
 
 ```sh
-aube exec playwright install chromium
+pnpm install
+pnpm exec playwright install chromium
 ```
 
 Core commands:

docs/CONTRIBUTING.md

@@ -9,10 +9,11 @@ mise install
 mise run bootstrap
 ```
 
-Fallback setup after installing `aube` directly:
+Fallback setup after installing `pnpm` directly (use the npm-distributed build, which bundles the `node-gyp` that `node-pty` needs on Linux):
 
 ```bash
-aube exec playwright install chromium
+pnpm install
+pnpm exec playwright install chromium
 ```
 
 ## Day-to-day workflow

docs/INSTALL.md

@@ -99,7 +99,7 @@ When you need a deterministic local artifact before publishing a GitHub Release,
 
 ```bash
 TARBALL_DIR=$(mktemp -d)
-aube ci
+pnpm install --frozen-lockfile
 npm run pack:private -- --pack-destination "$TARBALL_DIR"
 
 INSTALL_PREFIX=$(mktemp -d)

docs/adr/0009-release-please-with-communique-notes.md

@@ -24,7 +24,7 @@ Decisions inside that frame:
 - **`[Unreleased]` stays, as Communique's anchor and draft inbox.** Communique hard-requires the heading and reconciles any hand-staged draft body into the notes it generates. Release-please's stock Changelog updater would insert new sections _above_ that heading (its insertion regex matches `## [Unreleased]`), so a custom updater — wired in by re-registering the `node` release type with a small strategy subclass — inserts the release section below the anchor and clears the reconciled draft so it cannot leak into later releases. The two workflows that maintained/consumed the old heading pair are still retired; the release PR remains the authoritative unreleased view.
 - **Version bumps from Conventional Commits** with `bump-minor-pre-major` + `bump-patch-for-minor-pre-major`, matching the project's pre-1.0 history (breaking → minor, feat/fix → patch); `Release-As` footers override.
 - **Tags and releases are created non-draft** by the runner, which then dispatches the existing `release.yml` by tag input — tags created with the workflow token never fire `push: tags` triggers, and the repo already uses explicit `gh workflow run` dispatch for exactly this class of problem (CI on bot branches). `release.yml` keeps quality gates, the verified tarball, editorial Communique notes, assets, and npm trusted publishing unchanged; it briefly leaves the Release with changelog-style notes and no assets until it completes.
-- **release-please is a pinned devDependency** installed by the normal `aube ci` bootstrap. Its CJS-only octokit 9.x line carries no npm provenance attestations, so `@octokit/endpoint@9.0.6` is excluded from aube's trust policy in `pnpm-workspace.yaml` with justification.
+- **release-please is a pinned devDependency** installed by the normal frozen `pnpm install` bootstrap. Its CJS-only octokit 9.x line carries no npm provenance attestations, so `@octokit/endpoint@9.0.6` is excluded from the package manager's trust policy in `pnpm-workspace.yaml` with justification.
 
 ## Consequences
 

mise.toml

@@ -1,9 +1,12 @@
 [tools]
 actionlint = "1.7.12"
-aube = "1.10.4"
 communique = "1.1.3"
 jq = "1.8.1"
 node = "26"
+# The npm build of pnpm bundles node-gyp, which node-pty needs on Linux (it
+# ships no Linux prebuilds). The standalone binary (`pnpm = ...`) does not.
+# Stay on pnpm 10 until Dependabot's pnpm 11+ support settles.
+"npm:pnpm" = "10.34.5"
 python = "3"
 tmux = "3.6a"
 # VHS needs ttyd, but ttyd ships no macOS binary, so it's Linux/CI-only here.
@@ -14,11 +17,11 @@ zizmor = "1.25.2"
 
 [tasks.bootstrap]
 description = "Install deps and Chromium for local development"
-run = "aube exec playwright install chromium"
+run = "pnpm install && pnpm exec playwright install chromium"
 
 [tasks.bootstrap-ci]
 description = "Install deps for CI without browser downloads"
-run = "aube ci"
+run = "pnpm install --frozen-lockfile"
 
 [tasks.clean]
 description = "Clean artifacts"
@@ -129,7 +132,7 @@ sources = [
 
 [tasks.audit]
 description = "Fail on high-severity dependency advisories"
-run = "aube audit --audit-level high"
+run = "pnpm audit --audit-level high"
 
 [tasks.format]
 description = "Format"
@@ -201,3 +204,6 @@ run = "mise run format-check && mise run workflow-lint && mise run lint && mise
 
 [settings]
 lockfile = true
+# Install npm-backend tools (pnpm) with npm itself, not whichever package
+# manager mise auto-detects on the host.
+npm.package_manager = "npm"

package.json

@@ -19,7 +19,7 @@
     "url": "git+https://github.com/coder/agent-tty.git"
   },
   "type": "module",
-  "packageManager": "aube@1.2.0",
+  "packageManager": "pnpm@10.34.5",
   "engines": {
     "node": ">=24.0.0 <27"
   },
@@ -90,23 +90,23 @@
     "@coder/libghostty-vt-node": "0.1.0-beta.0"
   },
   "pnpm": {
-    "allowBuilds": {
-      "@coder/libghostty-vt-node": true,
-      "esbuild": true,
-      "fsevents": true,
-      "node-pty": true,
-      "@parcel/watcher": true,
-      "msgpackr-extract": true
+    "onlyBuiltDependencies": [
+      "@coder/libghostty-vt-node",
+      "esbuild",
+      "fsevents",
+      "msgpackr-extract",
+      "node-pty",
+      "@parcel/watcher"
+    ],
+    "overrides": {
+      "@xmldom/xmldom": "0.8.15",
+      "brace-expansion": "5.0.9",
+      "esbuild": "0.28.1",
+      "js-yaml": "4.3.2",
+      "nanoid": "3.3.18",
+      "postcss": "8.5.18",
+      "vite": "8.0.16",
+      "ws": "8.21.0"
     }
-  },
-  "overrides": {
-    "@xmldom/xmldom": "0.8.15",
-    "brace-expansion": "5.0.9",
-    "esbuild": "0.28.1",
-    "js-yaml": "4.3.2",
-    "nanoid": "3.3.18",
-    "postcss": "8.5.18",
-    "vite": "8.0.16",
-    "ws": "8.21.0"
   }
 }