Removed dependency leaves a dangling node_modules/.bin shim after cache expiry

[mwolson]

With isolated linking and its default regular-file bin wrappers, removing a dependency leaves its .bin shim behind. Once the documented orphan-cache retention expires, install removes the package-store entry but keeps the shim, so aube run fails with MODULE_NOT_FOUND instead of finding a replacement executable on PATH.

• Aube: 2.6.0 linux-x64 (2026-09-28).
• Node: v26.8.1.
• Repro: removed-dep-stale-bin-shim.

git clone https://github.com/mwolson/tmp-aube-issues
cd tmp-aube-issues/removed-dep-stale-bin-shim
./repro.sh

The fixture installs only semver@7.7.2, a pure-JavaScript package with no dependencies, then removes it. To avoid waiting seven days, the script uses fs.lutimesSync to age only semver's project-local virtual-store entry by eight days; it does not delete package files or modify shared-store contents.

All three removal paths reproduce with the global virtual store enabled and disabled:

1. aube remove semver.
2. Delete semver from the manifest, then aube install.
3. Copy an updated manifest and aube lockfile generated separately with install --lockfile-only over an existing install, then aube install, simulating a pulled removal.

Expected: the removed command disappears from .bin, and the script uses the fixture's replacement executable on PATH.

Actual: the manifest, lockfile, and .aube/semver@7.7.2 entry no longer contain semver, but .bin/semver still points to .aube/semver@7.7.2/node_modules/semver/bin/semver.js. A follow-up install says Already up to date and leaves it. aube run check exits 1 with MODULE_NOT_FOUND; the repro reports six failing cases and exits 1.

In this fixture, install --force and aube prune also leave the shim. aube ci removes it and restores PATH fallback in all six cases. The report concerns the surviving executable shim, while retaining orphaned package-store entries until their cache age expires is documented behavior.

[jdx]

Thanks for the detailed report and the repro. I reproduced this, and it's a bug: node_modules/.bin was never pruned during install, so a removed dependency's shim outlived it. aube prune only removes dangling symlinks, so it missed the default regular-file shims too. That's why aube ci was the only path that cleaned it up.

I opened #1673. After linking, install now removes any command in an importer's .bin/ that the current graph no longer claims, right away rather than after the orphan-cache retention expires. It only removes shims aube wrote (and symlinks pointing into the virtual store or node_modules), so files from lifecycle scripts or users are left alone. That covers aube remove, deleting the dependency from the manifest, and a pulled removal.

I haven't run your exact repro.sh with the 8-day timestamp aging, since the fix doesn't depend on cache age. I covered the aube remove and manifest-edit paths with tests instead. It would help if you could run your script against the PR build once it lands.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[mwolson]

Thanks for the quick fix. I ran the repro against the #1673 CI build (aube-ubuntu-latest artifact from head ae8407d, reports 2.6.1-DEBUG linux-x64 (2026-09-29)):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: removed-dep-stale-bin-shim

AUBE_BIN=/path/to/pr-build/aube ./repro.sh

• PR build: exit 0, 0/6 cases retained a removed dependency's bin. After the 8-day aging, aube remove, the manifest edit, and the pulled manifest and lockfile all remove the shim, with the global virtual store on and off, and aube run falls back to the command on PATH.
• Control, released 2.6.0 on the same machine: exit 1, 6/6 cases keep the shim.

I also checked without the aging step: the shim is gone after the next install while node_modules/.aube/semver@7.7.2 stays under normal retention, as you described. I'll retest again once it ships in a release.

[mwolson]

Retested with the release, aube 2.7.0 linux-x64 (2026-10-07):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: removed-dep-stale-bin-shim

./repro.sh exits 0 with 0/6 cases retained a removed dependency's bin, matching the #1673 PR build. All three removal paths drop the shim with the global virtual store on and off, and aube run falls back to the command on PATH.

Fix shipped in aube 2.7.0 via #1673. Marking your reply as the answer.