Summary

Mirrors pnpm's --pnpmfile <path> (override the local pnpmfile location) and --global-pnpmfile <path> (run a second pnpmfile before the local one). Composition order matches pnpm: global runs first, local runs second, so per-project hooks override org-wide rules.

Wired through both aube install and aube update (which forwards into the chained install with chained_frozen_mode(Prefer)). All three hook contracts honor the chain: readPackage (hot-loop NDJSON host), afterAllResolved (one-shot per pnpmfile), and preResolution (fire-and-forget per pnpmfile).

Unblocks 4 hooks.ts ports — bumps test/pnpm_install_hooks.bats from 8/22 to 12/22 (lines 85, 110, 135, 176) — see the PNPM_TEST_IMPORT.md entry for the running tally.

Implementation

New in crates/aube/src/pnpmfile.rs:

• detect() gains a CLI-override arg. Precedence is cli > workspaceYaml > default. Typos at any layer are a hard miss with a warning, never a silent fallback.
• detect_global() resolves --global-pnpmfile. No default location — pnpm requires the path to be passed explicitly.
• ordered_paths() flattens (global, local) into pnpm's run order. Single source of truth so the chain ordering doesn't drift across call sites.
• ReadPackageHostChain spawns one node child per pnpmfile that declares a readPackage hook and pipes each call through them in order. Skips spawning a host for any pnpmfile that doesn't declare the hook (saves the per-call JSON round-trip). When only one host has the hook, it's a thin wrapper over ReadPackageHost::call.
• run_after_all_resolved_chain / run_pre_resolution_chain keep the same global-first-then-local contract for the other two hook surfaces.

Wiring through:

• crates/aube/src/commands/install/mod.rs — both the --lockfile-only fast path (line ~1908) and the streaming-resolver path (line ~2353) replace single-pnpmfile call sites with the new chain helpers.
• crates/aube/src/commands/update.rs — local resolve gets the chain; flags propagate into the chained install at the end of the function.
• crates/aube/src/commands/mod.rs — run_pnpmfile_pre_resolution now takes a &[PathBuf] so the global-first ordering lives in ordered_paths rather than being re-derived at each call site.
• InstallOptions gains pnpmfile and global_pnpmfile fields (Option<PathBuf>), defaulted to None in with_mode and the literal struct constructions in ci.rs / deploy.rs.

Settings

Both settings carry typedAccessorUnused = true because they're consumed via direct fields on InstallOptions rather than the codegen accessor — same pattern as pnpmfilePath already used pre-PR.

Test plan

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test — 338 passing, including 13 new pnpmfile unit tests (CLI override precedence, absolute paths, missing-target hard-misses, chain ordering) and the strict cli_ordering_tests::test_cli_ordering
• mise run test:bats test/pnpm_install_hooks.bats — 14/14 (12 pass + 2 documented divergences skipped)
• mise run test:bats test/install.bats test/update.bats test/pnpmfile.bats — 80/80 regression sweep
• aube install --help and aube update --help show both new flags
• CLI docs regenerated via mise run render

bats note: package substitution

The pnpm tests use is-positive@1.0.0 / is-positive@3.0.0 to demonstrate composition (global pins one version, local downgrades). is-positive isn't mirrored in test/registry/storage/ yet, so the bats ports use is-number@3.0.0 / is-number@7.0.0 (already mirrored, has the two-distinct-versions shape the test needs). The substitution is called out in the test comment.

🤖 Generated with Claude Code