Hoisted installs omit transitive .bin links, breaking bcrypt's install script

[therockstorm]

With --node-linker=hoisted, Aube installs @mapbox/node-pre-gyp but does not create a reachable node-pre-gyp executable link. As a result, bcrypt@5.1.1 fails during installation. The same manifest and npm lockfile pass with npm and with Aube's isolated linker.

Environment

• Aube 2.2.17 macos-arm64 (2026-09-15)
• Node 24.15.0, npm 11.12.0
• macOS, Apple Silicon
• Public npm registry, fresh directories and dedicated package caches

Reproduction

Run with the versions above. No workspace or private registry is needed.

repro_dir=$(mktemp -d)
cd "$repro_dir"
export npm_config_userconfig="$repro_dir/empty.npmrc"
export npm_config_cache="$repro_dir/npm-cache"
export npm_config_registry=https://registry.npmjs.org/
export AUBE_STORE_DIR="$repro_dir/aube-store"
export AUBE_CACHE_DIR="$repro_dir/aube-cache"
export XDG_CONFIG_HOME="$repro_dir/config"
touch "$npm_config_userconfig"

mkdir seed npm-control aube-hoisted
cat > seed/package.json <<'JSON'
{
  "name": "aube-bcrypt-bin-repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": { "bcrypt": "5.1.1" }
}
JSON

(cd seed && npm install --package-lock-only --ignore-scripts --no-audit --no-fund)
cp seed/package.json seed/package-lock.json npm-control/
cp seed/package.json seed/package-lock.json aube-hoisted/

# Control: succeeds.
(cd npm-control && npm ci --no-audit --no-fund)

# Reproduction: fails during bcrypt's install script.
cd aube-hoisted
aube install --frozen-lockfile --node-linker=hoisted --no-side-effects-cache

Actual output:

sh: node-pre-gyp: command not found
  × lifecycle script install failed for bcrypt@5.1.1: script `install` exited
  │ with code Some(127)

The failed install contains node_modules/@mapbox/node-pre-gyp/bin/node-pre-gyp (@mapbox/node-pre-gyp@1.0.11), but neither of these exists:

node_modules/.bin/node-pre-gyp
node_modules/bcrypt/node_modules/.bin/node-pre-gyp

Expected behavior

A dependency's install script should be able to invoke executables from its declared dependencies. bcrypt should install successfully with the hoisted linker.

Using a third fresh directory with the same manifest and lockfile, Aube's --node-linker=isolated --no-side-effects-cache install succeeds. Both npm and isolated Aube also pass this native-module check:

node -e 'const b = require("bcrypt"); if (!b.compareSync("probe", b.hashSync("probe", 4))) process.exit(1)'

Likely cause

In the 2.2.17 bin-linking implementation, the root pass links direct dependencies. The per-dependency pass returns early for hoisted layouts.

PR #122 fixed this class of failure for isolated installs and explicitly excluded hoisted transitive bins. This reproduction demonstrates the remaining gap using a single direct dependency. Hoisted installs need the appropriate executable links available before dependency lifecycle scripts run.

[jdx]

Thanks — the diagnosis was exactly right, and the pointers to both call sites saved a lot of time. Fix is up in #1548.

Your reproduction turned out to have an offline equivalent in the repo: the aube-test-transitive-consumer → aube-test-transitive-bin fixtures from #122, run with --node-linker=hoisted, fail the same way. That is now a regression test.

On the cause: the isolated layout solves transitive bins with a per-dep .aube/<dep_path>/node_modules/.bin/, which a hoisted tree has nowhere to put — so that pass returned early and hoisted installs got only the importers' direct dependencies. Hoisted installs now follow npm's rule instead: each package's own bins go into the .bin/ of the node_modules/ directory that package sits in, which is already the directory on the lifecycle script's PATH. Collisions keep whatever is on disk, so a transitive package can't shadow a command you declared yourself.

Running your reproduction unchanged against the patched binary:

$ aube install --frozen-lockfile --node-linker=hoisted --no-side-effects-cache
node-pre-gyp info ok
✓ installed 59 packages in 515ms

$ node -e 'const b = require("bcrypt"); if (!b.compareSync("probe", b.hashSync("probe", 4))) process.exit(1)'

The native-module check passes, and node_modules/.bin now matches npm ci's on the same lockfile:

$ diff <(ls npm-control/node_modules/.bin) <(ls aube-hoisted/node_modules/.bin)
color-support mkdirp node-pre-gyp nopt rimraf semver

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5; version: 2.1.270.