feat(cli): aube add accepts git-spec arguments by jdx · Pull Request #475 · endevco/aube

jdx · 2026-05-02T19:46:21Z

Summary

New git-spec branch in parse_pkg_spec routes bare user/repo, github:/gitlab:/bitbucket:, git+https://, git+ssh://, scp form, and aliased myname@<git-spec> through a manifest-write path that skips the registry packument fetch and version-resolution loop. The chained aube install clones the repo and writes the lockfile entry on its own.
Manifest-key heuristic uses the trailing path segment of the parsed clone URL with .git stripped: kevva/is-negative -> is-negative, git+https://github.com/owner/some-pkg.git -> some-pkg. When the package's published name differs from the repo (e.g. microsoft/vscode-typescript publishes as typescript), users supply the alias explicitly via aube add typescript@microsoft/vscode-typescript.
Three network-gated end-to-end ports in test/pnpm_update_slow.bats restore the dropped kevva/is-negative assertions for pnpm/test/update.ts:143/170/197 — each exercises aube add kevva/is-negative alongside registry deps and confirms the github shorthand survives aube update --latest / -E / -L <name>.

Completes the GitHub-shorthand work end-to-end. The parser-side prerequisite landed in #472 (parse_git_spec recognizes bare user/repo, update.rs skips git specs in the manifest-rewrite loop); this PR is the CLI add path.

Test plan

cargo test --workspace — 611+ tests pass
cargo clippy --all-targets -- -D warnings — clean
cargo fmt --check — clean
11 new unit tests in commands::add::tests covering bare shorthand, github: protocol, git+https:// (with and without .git), committish preservation, aliased forms (bare + protocol), scoped pkg / relative path / single-token negatives, scp form
mise run test:bats test/pnpm_install_misc.bats — 30/30 (bare aube add regression — aube add with no args still errors as before)
mise run test:bats test/pnpm_update.bats — 22/22 offline tests pass
AUBE_NETWORK_TESTS=1 mise run test:bats test/pnpm_update_slow.bats — 4/4 (existing regression guard + 3 new restored ports)

Note

Medium Risk
Adds new parsing and manifest-write behavior for git-based dependencies, which changes how aube add interprets common user/repo-style inputs and bypasses registry resolution; mistakes here could write incorrect dependency keys/specs to package.json. Coverage includes new unit tests and network-gated end-to-end bats tests to reduce regression risk.

Overview
aube add now recognizes git dependency specs (e.g. bare user/repo, github:/gitlab:/bitbucket:, git+https:///git+ssh://, scp form, and myalias@<git-spec>), derives a manifest key from the repo URL’s last path segment, and writes the verbatim git spec into package.json for install-time resolution.

The add pipeline skips registry packument fetch/version resolution and catalog handling for git specs, reuses a shared helper to consistently scrub/insert the dependency into the correct dep section, and adds unit + network-gated bats tests to validate that git shorthands survive aube update --latest flows.

^{Reviewed by Cursor Bugbot for commit 7249ec4. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-05-02T19:48:53Z

Greptile Summary

This PR completes the GitHub-shorthand (user/repo, github:, gitlab:, bitbucket:, git+https://, git+ssh://, SCP form) end-to-end by wiring the new parse path into aube add, writing the verbatim spec to package.json, and skipping the packument/registry loop entirely. The apply_dep_to_section refactor cleanly consolidates the three manifest-write paths (registry, workspace, git) into one place.

Confidence Score: 5/5

Safe to merge — no logic or data-integrity regressions found; changes are well-isolated and covered by unit + bats tests.

All findings are P2 (style/test-coverage); no P0 or P1 issues identified. The git-spec parsing, manifest-write path, section-scrub logic, and catalog-bypass warning are all correct.

No files require special attention.

Important Files Changed

Filename	Overview
crates/aube/src/commands/add.rs	Adds git-spec parsing to parse_pkg_spec, introduces git_spec_manifest_key for URL→repo-segment derivation, applies apply_dep_to_section refactor across registry/workspace/git paths, and adds apply_git_spec_to_manifest with --save-catalog warning. Logic is correct; 11 new unit tests cover the key forms.
test/pnpm_update_slow.bats	Three new network-gated end-to-end tests restore kevva/is-negative assertions from pnpm/test/update.ts:143/170/197; teardown correctly adds @pnpm.e2e/foo to the git-restore list. Test structure and assertions are sound.
test/PNPM_TEST_IMPORT.md	Status entries for update.ts:14/143/170/197 and the parser-side work updated from 'partially landed' to 'done'; accurately reflects what this PR delivers.

_{Reviews (4): Last reviewed commit: "test: restore @pnpm.e2e/foo dist-tag in ..." | Re-trigger Greptile}

github-actions · 2026-05-02T19:58:39Z

Benchmark changes

Public ratios: warm installs vs Bun 7x -> 8x; warm installs vs pnpm 11x -> 13x.

Benchmark	aube	bun	pnpm
Fresh install (warm cache)	332ms -> 202ms (-39%)	2242ms -> 1655ms (-26%)	3500ms -> 2606ms (-26%)
CI install (warm cache, GVS disabled)	930ms -> 433ms (-53%)	1447ms -> 1855ms (+28%)	2475ms -> 2487ms (+0%)
CI install (cold cache, GVS disabled)	4364ms -> 3969ms (-9%)	4083ms -> 3981ms (-2%)	5380ms -> 5037ms (-6%)

jdx · 2026-05-02T20:01:09Z

Addressed all three review comments in 8a7485a:

Greptile P2 (--save-catalog silently ignored for git specs): apply_git_spec_to_manifest now tracing::warn!s when opts.save_catalog.is_some(), with the rationale (catalogs only apply to versioned registry deps).
Greptile P2 (discarded _name binding): replaced if let Some(_name) = git_spec_manifest_key(after) with if git_spec_manifest_key(after).is_some() and added a comment explaining the alias is the manifest key.
Cursor low (triplicated scrub-and-insert): extracted apply_dep_to_section(manifest, name, spec, opts) helper, replaced all three call sites (registry, workspace:, git-spec). Net -33 LOC, dep-section rules live in one place.

Verified: cargo build/clippy/fmt clean, cargo test -p aube commands::add 25 pass, mise run test:bats test/pnpm_update.bats 22/22, mise run test:bats test/pnpm_install_misc.bats 30/30.

Written with Claude.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8a7485a. Configure here.}

The third slow test mutates `@pnpm.e2e/foo`'s `latest` dist-tag via `add_dist_tag`, but the teardown's `git checkout` list missed it — leaving the on-disk fixture polluted across runs and violating the "MUST restore via git checkout" convention documented in common_setup.bash. Add `foo/package.json` to the restore list. Mirrors the existing entries for bar / dep-of-pkg-with-1-dep / qar. Addresses Cursor Bugbot medium on PR #475. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

jdx · 2026-05-02T20:51:01Z

Addressed Cursor's medium-severity finding in 192cabe: added @pnpm.e2e/foo/package.json to the slow file's teardown git checkout list, mirroring the existing entries for bar / dep-of-pkg-with-1-dep / qar. The third slow test mutates foo's latest dist-tag via add_dist_tag but the restore step was missing — would leave the on-disk fixture polluted across runs.

The other Cursor comment ("Triplicated dependency scrub-and-insert") is a stale re-attachment from commit 46e550e — it was already addressed by the apply_dep_to_section extraction in 8a7485a (which got -33 LOC consolidating all three call sites into the helper).

Written with Claude.

Routes bare `user/repo`, `github:`/`gitlab:`/`bitbucket:`, `git+https://`, `git+ssh://`, scp form, and aliased `myname@<git-spec>` through a new parse_pkg_spec branch that derives the manifest key from the URL's repo segment and writes the user's verbatim spec into package.json. Skips the packument fetch and version-resolution loop for git specs; the chained `aube install` clones the repo and writes the lockfile entry on its own. Manifest-key heuristic uses the trailing path segment with `.git` stripped (`kevva/is-negative` -> `is-negative`, `git+https://github.com/owner/some-pkg.git` -> `some-pkg`). When the package's published name differs from the repo, users supply the alias explicitly: `aube add typescript@microsoft/vscode-typescript`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds three network-gated bats tests in pnpm_update_slow.bats mirroring pnpm/test/update.ts:143/170/197 with the dropped `kevva/is-negative` assertions restored end-to-end. Each test exercises the new `aube add <bare-shorthand>` path before the registry deps, so the github shorthand lands in package.json from the CLI rather than a manifest-declared dep + `aube install`. Updates PNPM_TEST_IMPORT.md to mark the github-shorthand resolution work done — parser branch (PR #472) + update --latest skip (PR #472) + CLI add support land the full end-to-end story for pnpm's update.ts:14 /143/170/197. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Three paths in `aube add` (registry, `workspace:`, git-spec) were emitting the same ~20-line scrub-then-insert block. Pulled the logic into `apply_dep_to_section` so the dep-section rules (which sections get cleared, how `--save-peer` + `--save-dev` combine) live in one place. Net -33 LOC. Also surfaces `--save-catalog` as a no-op for git-spec deps via `tracing::warn!` so users don't think the flag silently took effect (catalogs only apply to versioned registry deps), and renames the `_name` discard binding in the alias-form parse branch to make the intent explicit (the alias is the manifest key; the URL-derived name is irrelevant). Addresses Greptile P2 (save-catalog silent no-op + discarded _name) and Cursor low (triplicated scrub-and-insert). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The third slow test mutates `@pnpm.e2e/foo`'s `latest` dist-tag via `add_dist_tag`, but the teardown's `git checkout` list missed it — leaving the on-disk fixture polluted across runs and violating the "MUST restore via git checkout" convention documented in common_setup.bash. Add `foo/package.json` to the restore list. Mirrors the existing entries for bar / dep-of-pkg-with-1-dep / qar. Addresses Cursor Bugbot medium on PR #475. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

jdx · 2026-05-02T22:03:41Z

Superseded by #483 — same feature (aube add accepting git specs), more recent iteration with full review coverage. Closing in favor of that PR.

Written with Claude.

greptile-apps Bot reviewed May 2, 2026

View reviewed changes

Comment thread crates/aube/src/commands/add.rs

Comment thread crates/aube/src/commands/add.rs Outdated

cursor Bot reviewed May 2, 2026

View reviewed changes

Comment thread crates/aube/src/commands/add.rs

cursor Bot reviewed May 2, 2026

View reviewed changes

Comment thread test/pnpm_update_slow.bats

jdx and others added 4 commits May 2, 2026 17:02

jdx force-pushed the worktree-agent-aa141170cd4b656b9 branch from 192cabe to 7249ec4 Compare May 2, 2026 22:03

jdx closed this May 2, 2026

This was referenced May 3, 2026

feat(cli): support link: and file: specs in aube add #487

Merged

feat(cli): support yaml-only workspace roots in list/run/install/query/why #486

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(cli): aube add accepts git-spec arguments#475

feat(cli): aube add accepts git-spec arguments#475
jdx wants to merge 4 commits intomainfrom
worktree-agent-aa141170cd4b656b9

jdx commented May 2, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented May 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026 •

edited

Loading

Uh oh!

jdx commented May 2, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

jdx commented May 2, 2026

Uh oh!

jdx commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented May 2, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

greptile-apps Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmark changes

Uh oh!

jdx commented May 2, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jdx commented May 2, 2026

Uh oh!

jdx commented May 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented May 2, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented May 2, 2026 •

edited

Loading

github-actions Bot commented May 2, 2026 •

edited

Loading