…ofile

The packument-primer cache dir, the runtime crate's `cache_dir`, the
adaptive-state path, and the streamed deprecation hint all hardcoded the
`aube` cache namespace / product name. Route them through the active
embedder's `cache_namespace` / `name` so a host embedder lands its cache
beside the rest of aube's under its own namespace and brands the
mid-install hint at the emit site (where a later output-capture rewrite
never reaches). Standalone aube is unchanged — every value reduces to its
hardcoded literal.

Co-authored-by: Claude <noreply@anthropic.com>

…e profile

Sweep the leftover hardcoded `aube` identity, path, and namespace
literals onto the active embedder profile so a host embedder's brand,
paths, and config namespaces follow it everywhere:

- virtual-store leaf (`.aube`), runtime root (`aube/nodejs`), global
  package subdir (`global-aube`), patch-state and deploy-injected
  sidecars — derived from `name` / `data_namespace`.
- install-shape digest, `engines.<self>` key, and the `remove` sidecar
  namespaces — derived from `manifest_namespace` (+ `compatible_names`),
  skipping an empty namespace.
- self-version pin checks/messages, install-origin and runtime-provenance
  labels, doctor/update-notice/recursive-error product names, completion
  command name, login User-Agent and hostname fallback — derived from
  `name` / `version` / `self_names` / `user_agent`.
- branded env knobs (`AUBE_AUTH_TOKEN`, `AUBE_NO_BROWSER`, `AUBE_HOME`)
  gated on `env_prefix`; an embedder with no prefix reads no branded var.

Every site reduces to its original literal under standalone aube, so the
default identity is byte-for-byte unchanged.

Co-authored-by: Claude <noreply@anthropic.com>

…t (embed-safe entrypoint)

`cli_main` / `cli_main_with_defaults` called `std::process::exit`
internally, so a host that embeds the command layer in-process was
hard-killed by any non-zero command result or error. They now RETURN
the `i32` exit code; the binary's `main` owns the single
`std::process::exit(cli_main(..))`. Diagnostic rendering to stderr is
unchanged and every exit-code path (success / command result / miette
error → EXIT_TABLE) maps identically — standalone behavior is byte-for-
byte the same. Addresses jdx's jdx#862 follow-up.

Co-authored-by: Claude <noreply@anthropic.com>

…er comments

Removes two "nub" mentions that jdx#862 left in aube's tree; rewrites to generic
embedder-actor phrasing so aube's source stays downstream-neutral.

Co-authored-by: Claude <noreply@anthropic.com>

…al-store path + project-lock brand leak

Co-authored-by: Claude <noreply@anthropic.com>

… the fs-safe slug

Module and fn doc-comments in patch.rs and deploy/injection.rs still
referenced the old hardcoded `.aube_patch_state.json` / `.aube-deploy-injected`
names after those filenames became dynamic (derived from `embedder().name`).
Update them to describe the `.<name>_patch_state.json` / `.<name>-deploy-injected`
pattern with a standalone-aube resolution note, matching the idiom already used
in aube-linker and aube/src/state.rs.

Also tightens the `Embedder::name` field doc to state explicitly that `name` is
the filesystem- and command-safe identity slug (not a display label), and that
it is used verbatim in on-disk paths — addressing a reviewer concern that paths
derived from `name` could be unsafe.

co-authored-by: Claude <noreply@anthropic.com>

…nv_prefix helpers

Adds the embedder env-prefix pluggability helpers on top of the embedder
profile (jdx#862), so an embedding host can hide aube's branded env surface
without patching every read site.

- aube_util::env::embedder_env(suffix) reads {env_prefix}_<SUFFIX> — the
  tool's internal debug/diagnostic/perf-bisect toggles (DISABLE_*, DIAG_*,
  CAS_*, INTERNAL_*, BENCH_*, self-update endpoints, NO_UPDATE_CHECK,
  RUNTIME_DIR). An embedder with env_prefix=None reads nothing, so no branded
  debug toggle leaks under the host's brand.
- aube_util::env::config_env(suffix) reads {config_env_prefix}_<SUFFIX> — the
  small set of first-class config knobs (the cache dir, the fetch
  concurrency) a host legitimately wants under its OWN brand.
- New Embedder field config_env_prefix: Option<&'static str> (alongside
  env_prefix), and AUBE sets it to Some("AUBE").
- All direct AUBE_* runtime reads now route through these helpers across
  aube-util / aube-store / aube-runtime / aube-registry / aube-resolver /
  aube (build-time AUBE_PRIMER_* reads in build.rs are left untouched).

Additive and no-op for standalone aube: with env_prefix=config_env_prefix=
Some("AUBE") every helper resolves the exact AUBE_* name read before. Proven
by the env-prefix-default unit tests and the new embedder_env_brand_gate
integration test (a nub-shaped profile: env_prefix=None hides AUBE_DISABLE_*,
config_env_prefix=Some("NUB") reads NUB_* and never AUBE_* for the config
knobs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…profile

Adds two user-facing source-branding helpers on top of the embedder profile
(jdx#862/jdx#888), the approach jdx approved over post-processing rendered output: a
user-facing miette!/bail!/eprintln!/println! string composes the program name
at the source instead of an embedder string-rewriting "aube" out of finished
output.

- aube_util::prog() -> &str — the bare program name for user-facing output
  (banners, "pinned {prog} version", …). Returns Embedder::name, the same slug
  the clap command name and on-disk sidecars already use.
- aube_util::cmd(verb) -> String — a "{prog} <verb>" command reference
  (cmd("install") -> "aube install"). Brands only the program prefix; the verb
  is the CLI spelling verbatim.

Additive and no-op for standalone aube: under the default AUBE profile prog()
is exactly "aube" and cmd("install") exactly "aube install" byte-for-byte.
Proven by the prog_and_cmd_render_aube_under_default_profile unit test and the
new source_branding_brand_gate integration test (a nub-shaped profile where the
helpers carry the host brand and "aube" never leaks).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… prog()/cmd()

Replaces hardcoded "aube" / "aube <verb>" brand literals in user-facing
runtime output — miette!/bail!/eprintln!/println!/wrap_err errors, hints, and
banners across the command layer — with the source-branding helpers
aube_util::prog() / aube_util::cmd(verb). This is the approach jdx approved over
post-processing rendered output: a user-facing string composes the program name
at the source, so a library consumer (nub, which embeds aube and rebrands its
output) gets its own brand in errors/help with no post-pass.

- ~120 user-facing command references across ~45 command-layer files now use
  cmd("install") / cmd("run") / cmd("deploy") / … for `aube <verb>` references
  and prog() for bare program-name references.
- Untouched (correctly): internal tracing logs, error/warning CODE constants
  (ERR_AUBE_*/WARN_AUBE_*), branded filenames (aube-lock.yaml,
  aube-workspace.yaml), manifest keys (package.json#aube, aube.<key>), doc
  comments, test fixtures, and clap help-text consts (a `&'static str` resolved
  at definition time — can't call a runtime helper; tracked as a follow-up).

Adds a conservative brand-literal lint (crates/aube/tests/brand_literal_lint.rs)
that scans the command layer and fails on a newly-introduced hardcoded
`aube <verb>` literal in a user-facing string, steering future code to cmd(...).
It exempts comments, tracing, clap help-text/`$ aube` examples, branded
filenames/keys, and a one-entry allowlist (a provenance data value). Module
docs explain how to satisfy it.

Default-preserving: under the default AUBE profile every converted site renders
byte-for-byte identical to the old literal, so standalone aube's output is
unchanged. cargo build/clippy/fmt clean; full workspace test suite green
(including the lint and the prog/cmd brand-gate tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… cmd()/prog()

…rocess::exit

The embeddable command layer (aube::commands::*::run and the script/bin
helpers they share) called std::process::exit directly on a failing
command or a non-zero child status. When a host embeds aube as a library
and drives those run() fns in-process, those exits hard-kill the host's
whole process.

Thread a propagatable exit code up through the command layer instead:
the converted run() / helper signatures return miette::Result<Option<i32>>
(Some(code) = "exit with this code", None = success). The dispatcher in
async_main maps Some(code) to the existing Result<Option<i32>> return, and
the binary's main.rs keeps the single std::process::exit. Standalone exit
codes are unchanged byte-for-byte.

Converted command-level sites: run/exec (parallel-collector + leaf
child-exit propagation), peers, doctor, check, dlx, create, outdated,
audit (degraded=2, fix-remaining=1, advisories=1), plus the run_script /
exec_bin / exec_script shared helpers and their callers (clean, restart,
install_test, lifecycle, recursive, External). SIGINT exit(130) in the
interactive pickers (run prompt, audit/update selectors) and the main.rs
re-exec are left as genuinely-terminal paths.

Add e2e tests pinning the standalone exit-code contract: run propagates a
failing script's exact code, --if-present on a missing script exits 0, and
a failing pre-script short-circuits with its code before the main script
runs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>