feat(add): linkWorkspacePackages + saveWorkspaceProtocol

[jdx]

Summary

Closes the workspace-protocol gap surfaced by pnpm's monorepo/index.ts batch 2 ports. Two new settings on aube add:

• linkWorkspacePackages (bool, default false): when true, aube add <name> prefers a local workspace sibling over the registry. The packument fetch is skipped, the manifest specifier is built from saveWorkspaceProtocol, and the resolver picks up the local copy on the next install (existing aube behavior on bare semver ranges, so no resolver change required).
• saveWorkspaceProtocol ("true" | "false" | "rolling", default "rolling"): controls the spec form written to package.json. rolling writes workspace:^ (no version), true writes workspace:^<version>, false writes ^<version>. The --save-workspace-protocol / --no-save-workspace-protocol CLI flags override per-invocation.

update_manifest_for_add now reads settings from the workspace yaml root rather than the immediate project dir so a sub-project's add picks up the workspace-wide policy.

Tests

Bats ports in test/pnpm_monorepo_index.bats:

• pnpm/test/monorepo/index.ts:112 (default saveWorkspaceProtocol, --save-dev, --save-optional --no-save-workspace-protocol)
• pnpm/test/monorepo/index.ts:156 (explicit saveWorkspaceProtocol: rolling)
• aube-side regression guard for saveWorkspaceProtocol: true (no pnpm equivalent; the three protocol variants share one code path so coverage of the third form is the only way to catch a silent regression there)

Test plan

• cargo clippy --all-targets -- -D warnings
• cargo fmt --check
• cargo test -p aube (430 tests)
• bats test/pnpm_monorepo_index.bats (9 tests, all green)

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes aube add dependency resolution and manifest-writing behavior in workspaces, which can alter package.json specifiers and skip registry fetches based on new settings/flags. Risk is moderated by explicit opt-in defaults, guardrails for aliases/range mismatches, and added bats coverage.

Overview
aube add can now prefer local workspace siblings over the registry via new linkWorkspacePackages (default false), skipping packument fetches when a matching sibling exists and writing the manifest entry according to saveWorkspaceProtocol (rolling workspace:^, pinned workspace:^<version>, or registry-style ^<version>).

Adds --save-workspace-protocol and --no-save-workspace-protocol flags to override the per-workspace policy for a single invocation, reads these workspace-owned settings from the workspace-yaml root (so subprojects honor workspace policy), updates workspace yaml schema/docs/CLI help generation, and introduces new bats tests covering rolling/pinned/opt-out behavior plus regression guards for aliases and explicit range mismatches.

^{Reviewed by Cursor Bugbot for commit 195e61d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR closes the workspace-protocol gap for aube add by introducing two new settings — linkWorkspacePackages and saveWorkspaceProtocol — along with matching --save-workspace-protocol / --no-save-workspace-protocol CLI flags. Both issues surfaced in the prior review cycle are resolved: the aliased-spec guard (spec.alias.is_some()) is now in the eligibility block, and the workspace_protocol_override tri-state is computed via a shared workspace_protocol_override_from_flags helper used by both run() and from_args().

• linkWorkspacePackages (default false) makes aube add <name> prefer a local workspace sibling over the registry; explicit version ranges that the sibling cannot satisfy correctly fall through to the registry path.
• saveWorkspaceProtocol (rolling / true / false, default rolling) controls the manifest spec form; workspace_settings_cwd reads settings from the workspace yaml root so sub-project adds honour the workspace-wide policy.
• Six new bats tests cover the rolling/pinned/registry variants, aliased-spec regression, and version-range mismatch/match guards.

Confidence Score: 5/5

The workspace-linking logic is well-guarded against tricky edge cases and the manifest-write branching is correct across all three saveWorkspaceProtocol variants.

Both defects identified in the previous review round are demonstrably fixed in this diff. The eligibility guards, version-satisfies check, spec-form selection, and per-invocation override all behave correctly under the scenarios tested and the edge cases examined during review. The bats suite provides concrete regression coverage for every code path including the aliased-spec and version-mismatch cases.

No files require special attention.

Important Files Changed

Filename	Overview
crates/aube/src/commands/add.rs	Core implementation of linkWorkspacePackages and saveWorkspaceProtocol; aliased-spec guard (spec.alias.is_some()) correctly added, workspace_protocol_override_from_flags helper eliminates the duplicate computation flagged in the prior review.
crates/aube-manifest/src/workspace.rs	Adds link_workspace_packages (Option) and save_workspace_protocol (Option<yaml_serde::Value>) fields to WorkspaceConfig; "deep" is explicitly documented as unsupported so the plain-bool typing is intentional.
crates/aube-settings/settings.toml	Declares linkWorkspacePackages and saveWorkspaceProtocol with correct source chains (env, npmrc, workspaceYaml); no CLI source intentionally since the flags are handled in AddArgs.
test/pnpm_monorepo_index.bats	Six new bats tests cover rolling/pinned/registry spec forms, aliased-spec regression, version-range mismatch guard, and version-range match; well-structured fixture and assertions.
aube.usage.kdl	Adds --save-workspace-protocol and --no-save-workspace-protocol flag definitions with accurate long-help text; clap overrides_with wiring is consistent.
docs/cli/add.md	Documentation for the two new flags matches the implementation; no inaccuracies found.
docs/cli/commands.json	Generated JSON entries for the two new flags are consistent with the KDL and Markdown docs.
docs/settings/index.md	Settings reference correctly documents both new settings, their source chains, and the intentional non-support of pnpm's "deep" value.

_{Reviews (3): Last reviewed commit: "fix(add): validate range against sibling..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8dbfeed. Configure here.}