Dependencies

aube, with pnpm's lockfile

Agent Zero uses aube as its package manager, pinned through the packageManager field in the root package.json. aube reads and writes the existing pnpm-lock.yaml and pnpm-workspace.yaml in place, so the lockfile stays in pnpm's v9 format for anyone who still runs pnpm.

Do not use npm, Yarn, Bun, or another package manager in this repository, and do not add a second lockfile.

aube ci                                  # clean install from the lockfile
aube install                             # install, updating the lockfile if needed
aube add -F @agent-zero/runner destr     # add a dependency to one workspace
aube add -D -w oxfmt                     # add a root dev dependency

aube run <script> and aube test check install freshness first and install only when node_modules is stale, so a separate install step is rarely needed.

Workspaces

pnpm-workspace.yaml declares two workspace globs:

packages:
  - apps/*
  - packages/*

Any directory added under either glob with a package.json becomes a workspace automatically. Turborepo picks up its build, dev, lint, test, and typecheck scripts when they exist; packages without a given script are skipped, not failed.

The TypeScript override

pnpm-workspace.yaml overrides typescript repo-wide:

overrides:
  typescript: npm:typescript-native-bridge@6.0.3-bridge.12.tsgo.7.0.2

typescript-native-bridge is a drop-in fork whose checker runs on tsgo in-process, so tsc and every Compiler API consumer type-check natively. Two rules follow:

• Keep the pin exact. The fork only publishes prerelease versions, which caret ranges never match.
• Reinstall after changing it. tsc prints TNB ACTIVE to stderr on the first type-check in a process; no banner means stock TypeScript is loaded and the install is stale.

The @nuxt/schema override

pnpm-workspace.yaml also pins @nuxt/schema:

overrides:
  '@nuxt/schema': npm:@nuxt/schema@4.5.2

@redstardev/unplugin-version-injector pulls in an older @nuxt/schema than the nuxt@4.5.2 the workspace actually runs. Two instances of the package mean two nominally different DefineNuxtConfig types, so wherever the older one wins resolution, defineNuxtConfig(...) type-checks as "not callable". The override forces every consumer onto the one Nuxt version already in use.

Build scripts

onlyBuiltDependencies in pnpm-workspace.yaml allow-lists the dependencies whose lifecycle scripts may run (currently only esbuild). Everything else installs without executing scripts, which keeps aube ci deterministic and safe.