pnpm-lock.yaml writes workspace:* dependencies by version instead of link:, breaking pnpm frozen installs

[mwolson]

When aube writes pnpm-lock.yaml, it records workspace:* dependencies by the workspace package's version instead of pnpm's link: path. pnpm then refuses a frozen install of that lockfile.

• aube: 2.7.0 linux-x64 (2026-10-07), also 2.6.1 and 1.41.0
• pnpm: 11.10.0 and 12.8.1
• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-workspace-link-version

PNPM_BIN=/path/to/real/pnpm ./repro.sh

packages/app depends on workspace packages @x/shared (version 1.2.3) and @x/extra through workspace:*, and on a local directory package @x/md (file:../../modules/md) that peers on @x/shared. The committed pnpm-lock.yaml was written by pnpm 11.10.0 before @x/extra was added. pnpm records:

importers:
  packages/app:
    dependencies:
      '@x/md':
        specifier: file:../../modules/md
        version: file:modules/md(@x/shared@packages+shared)
      '@x/shared':
        specifier: workspace:*
        version: link:../shared

snapshots:
  '@x/md@file:modules/md(@x/shared@packages+shared)':
    dependencies:
      '@x/shared': link:packages/shared

After aube install --no-frozen-lockfile:

      '@x/extra':
        specifier: workspace:*
        version: 1.0.0
      '@x/md':
        specifier: file:../../modules/md
        version: file:modules/md
      '@x/shared':
        specifier: workspace:*
        version: 1.2.3

snapshots:
  '@x/md@file:modules/md':
    dependencies:
      '@x/shared': 1.2.3

aube installs from this, but pnpm does not:

[ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY] Broken lockfile: no entry for '@x/extra@1.0.0' in pnpm-lock.yaml

A non-frozen pnpm 11.10.0 install restores the link: versions. pnpm 12.8.1 fails the same way without --frozen-lockfile and with --fix-lockfile. The rewrite also happens with no manifest drift under aube install --no-frozen-lockfile.

Found in pingdotgg/t3code: adding one unrelated dependency and running aube rewrote about 1,650 lockfile lines, and pnpm's frozen install then failed with no entry for '@t3tools/client-runtime@0.0.0' (workspace packages there are 0.0.0). Restoring only the 32 workspace link: values (30 importer entries and two peers in the file: package's snapshot) was enough for pnpm 11.10.0 to frozen-install the rest of aube's rewrite, so the other differences there (peer-suffix spelling, dropped transitivePeerDependencies) do not block pnpm.

[jdx]

Thanks for the detailed repro. Confirmed: a fresh resolve wrote workspace:* dependencies as the member's bare version, with no matching package entry, which pnpm rejects. aube now writes pnpm's link:<path> form for them: member-relative in importers (link:../shared), root-relative for snapshot edges such as the workspace peer of a file: package.

Fix is in #1719. I checked it against a scratch workspace shaped like your case and confirmed a frozen aube install from the result, but I haven't run pnpm against the output. The peer-suffix spelling and dropped transitivePeerDependencies differences are unchanged, since you found they don't block pnpm.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[mwolson]

Retested with aube 2.8.0 linux-x64 (2026-10-19):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-workspace-link-version

PNPM_BIN=/path/to/real/pnpm ./repro.sh

It now exits 0 with both pnpm 11.10.0 and 12.14.0 as the control. Aube writes link: versions for the workspace dependencies and the file: package's workspace peer, and pnpm frozen-installs the aube-written lockfile. Same result on 2.7.2.

Fix shipped in aube 2.7.1 via #1719. Marking your reply as the answer.