aube add fails once a direct file: dependency satisfies a peer

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: file-dep-peer-reresolve
• aube: 2.8.0 linux-x64 (2026-10-19) (also 2.7.2 and 1.41.0)

The project depends on react through file:deps/react and on use-sync-external-store@1.5.0, which declares react as a peer. A fresh aube install works. After that, any re-resolve fails, for example aube add is-number@7.0.0:

ERR_AUBE_BLOCKED_EXOTIC_SUBDEP
blocked exotic transitive dependency react@file:deps/react from use-sync-external-store@1.5.0

react is a direct dependency in the root package.json, which the security docs say stays allowed ("Direct deps you pin yourself in package.json are still allowed"). The hint even suggests pinning react in the root package.json, where it already is. With AUBE_BLOCK_EXOTIC_SUBDEPS=false the add fails differently:

ERR_AUBE_REGISTRY_ERROR
registry error for react: transitive local specifier file:deps/react cannot be resolved without the parent package source root

The same thing happens when starting from a pnpm-written lockfile. pnpm 11.10.0 and 12.14.0 run the same add without error.

PNPM_BIN=/path/to/real/pnpm ./repro.sh

I found this in pingdotgg/t3code, where apps/mobile depends on a react-native-screens tarball (file:deps/react-native-screens-*.tgz) that @react-navigation/native-stack peers on. aube cannot add, remove, or upgrade any dependency in that tree, so lockfile changes have to go through pnpm.

[jdx]

Thanks for the detailed repro. The cause: on a re-resolve, aube reuses the locked use-sync-external-store entry and re-enqueued each of its locked edges as a dependency. The peer edge react: file:deps/react was therefore treated as a transitive local source of a registry package, which hit the exotic-subdep block (and, with that disabled, the missing parent source root error). Peer edges that point at a file:/link:/git source are now skipped there, and the peer pass wires them from the importer as it does on a fresh install.

Fix is in #1775. I haven't run your repro repo or pnpm against it; the PR has no resolver test yet either.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[mwolson]

Retested with aube 2.8.1 linux-x64 (2026-10-20):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: file-dep-peer-reresolve

PNPM_BIN=/path/to/real/pnpm ./repro.sh

It now exits 0 with native pnpm 12.14.0 as the control. aube add is-number@7.0.0 succeeds after an aube install, after a pnpm install, and with AUBE_BLOCK_EXOTIC_SUBDEPS=false. In pingdotgg/t3code, aube add in apps/mobile works again too.

Fix shipped in aube 2.8.1 via #1775. Marking your reply as the answer.