add -C <dir> / --dir / --prefix writes to an ancestor package.json instead of <dir>

[mwolson]

• aube: 2.7.0 linux-x64 (2026-10-07)
• pnpm control: 12.11.2
• Repro: https://github.com/mwolson/tmp-aube-issues/tree/main/dir-flag-ancestor-package-json

When <dir> has no package.json, aube add <spec> -C <dir> walks up and adds
the dependency to the nearest ancestor package.json, leaving <dir> empty.
--dir and --prefix behave the same way.

mkdir -p outer/staging dep
echo '{"name":"outer","private":true}' > outer/package.json
echo '{"name":"dep","version":"1.0.0"}' > dep/package.json
aube add "file:$PWD/dep" -C outer/staging
cat outer/package.json   # now lists "dep"; outer/staging is empty

pnpm creates outer/staging/package.json and installs there, with --dir or
-C, before or after the command:

pnpm add "file:$PWD/dep" --dir outer/staging

npm's explicit --prefix uses the directory as-is too. Without a flag, pnpm and
aube both walk up from the cwd, so only the flag differs. I hit this through
tool installers that run npm install --prefix <staging-dir> <pkg>@<version>,
which ended up editing the enclosing project.

The -C help says "like make -C", so the walk-up may be intended. If it is,
should --prefix still mean npm's exact directory?

[jdx]

Thanks for the clear repro. You're right: -C / --dir / --prefix is meant to name the project directory, and add was walking up from it anyway. I opened #1751 so that aube add <spec> -C <dir> creates <dir>/package.json if needed and installs there, like pnpm's --dir and npm's --prefix.

It only changes add for now; other commands still walk up from -C <dir>.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: 2.1.289.

[mwolson]

Retested with aube 2.8.0 linux-x64 (2026-10-19):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: dir-flag-ancestor-package-json

PNPM_BIN=/path/to/real/pnpm ./repro.sh

It now exits 0 with native pnpm 12.14.0 as the control. aube add with -C, --dir, and --prefix each creates outer/staging/package.json and installs there. Same result on 2.7.2.

Fix shipped in aube 2.7.1 via #1751. Marking your reply as the answer.