aube: sync upstream v1.35.0

.claude/skills/aube-bump/SKILL.md

@@ -245,12 +245,18 @@ applies. Reverting was correct. Let the tests arbitrate; don't defend a graft.
 Grep after every bump — if one vanished, a resolution was wrong:
 
 ```sh
-grep -rn "workspace_markers\|lockfile_basename\|EmbedderProfile\|read_branded_pnpm_config\|env_prefix\|cache_namespace\|engine_context\|env_overlay\|path_prepends\|runtime_node\|cold_path" vendor/aube/crates
+grep -rn "workspace_markers\|lockfile_basename\|virtual_store_subdir\|branded_env_alias_enabled\|read_branded_pnpm_config\|env_prefix\|cache_namespace\|engine_context\|env_overlay\|path_prepends\|runtime_node\|cold_path" vendor/aube/crates
 ```
 
 - **Embedder profile plumbing** — `env_prefix`, `cache_namespace`, `lockfile_basename`,
-  `workspace_markers`, `read_branded_pnpm_config` gating. Holds the brand + config boundary. Largely
-  upstreamed, so it usually converges rather than conflicts.
+  `workspace_markers`, `virtual_store_subdir`, `read_branded_pnpm_config` gating. Holds the brand +
+  config boundary. Largely upstreamed, so it usually converges rather than conflicts. The profile type
+  is `Embedder` (`aube-util/src/identity.rs`), reached via `aube_util::embedder()`.
+  `virtual_store_subdir` earns its place in the grep: the v1.35 bump auto-merged two upstream call sites
+  that hardcoded `aube_store::VIRTUAL_STORE_SUBDIR` (`"virtual-store"`) over nub's profile-named leaf,
+  with **no conflict markers** — it would have shipped silently. `branded_env_alias_enabled`
+  (`aube-util/src/env.rs`) is the single switch gating every `AUBE_*` alias in `settings.toml`, so each
+  bump's new branded settings inherit the boundary from it alone.
 - **Linker** — GVS, collective hidden tree as the sole phantom mechanism, per-package
   force-materialization (`diskMaterializePackages`), workspace-spanning hoisted planning, memoized
   clonedir probes, whole-dir `clonefile` on macOS, direct-exec of native bins.

crates/nub-cli/src/pm_engine/vite_compat.rs

@@ -234,9 +234,17 @@ pub(crate) fn vite_lt_8_1(version: &str) -> bool {
 /// embedder-namespaced to `~/.cache/nub/pm`). This is the realpath prefix of
 /// every store-resident served module, so it is the value Vite must allow. The
 /// leaf name comes from the active embedder (`store` under nub), matching what
-/// `aube_store::Store::virtual_store_dir` writes, so the two never drift. The
-/// embedder profile is registered by the time install runs, so
-/// `aube_store::dirs::cache_dir()` resolves the nub namespace.
+/// `aube_store::Store::virtual_store_dir` writes. The embedder profile is
+/// registered by the time install runs, so `aube_store::dirs::cache_dir()`
+/// resolves the nub namespace.
+///
+/// Only the DEFAULT location is reproduced here. aube v1.35.0 added the
+/// `globalVirtualStoreDir` / `cacheDir` settings, which relocate the real store
+/// at runtime; the resolver for those (`commands::settings_context::
+/// global_virtual_store_dir`) is `pub(crate)` to the aube crate, so nub cannot
+/// consult it without widening that surface. A project that sets either setting
+/// therefore gets a `.modules.yaml` naming the default path rather than the
+/// relocated one, and Vite would not be told to allow the real store.
 fn global_virtual_store_dir() -> Option<PathBuf> {
     aube_store::dirs::cache_dir().map(|c| c.join(aube_util::embedder().virtual_store_subdir))
 }

vendor/aube/.github/renovate.json

@@ -8,6 +8,12 @@
       "matchManagers": ["cargo"],
       "matchPackageNames": ["/^sigstore-/"],
       "groupName": "sigstore crates"
+    },
+    {
+      "description": "decmpfs 0.1.2 fails to compile for musl targets (FICLONE ioctl request typed c_ulong, which is c_int on musl). Hold at 0.1.0 until upstream fixes it.",
+      "matchManagers": ["cargo"],
+      "matchPackageNames": ["decmpfs"],
+      "allowedVersions": "<=0.1.0"
     }
   ]
 }

vendor/aube/.github/workflows/auto-merge-release.yml

@@ -18,7 +18,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true