aube add deletes npm's auto-installed peer entries from package-lock.json, so npm ci fails

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-peer-entries
• aube: 2.8.2 linux-x64 (2026-10-23)

With only react-dom@19.1.1 declared, npm 11.6.2 auto-installs its react peer as a "peer": true entry. aube add is-number@7.0.0 removes that entry, and npm ci then fails:

npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: react@19.3.1 from lock file

When react and react-dom are both declared, aube instead drops "peer": true from react and adds react: 19.1.1 to react-dom's dependencies. npm leaves every existing entry alone on the same add in both cases.

NPM_BIN=/path/to/real/npm ./repro.sh

I expected aube to keep the peer, since its docs say autoInstallPeers is on by default. In a real project, a two-package dev add changed 27 of 233 existing entries, where npm changed 2.

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-bundled-entries
• aube: 2.8.2 linux-x64 (2026-10-23)

Another existing-entry rewrite in the same family: an unrelated
aube add is-number@7.0.0 --ignore-scripts removes bundleDependencies from an
existing entry. The smallest failing fixture I found has optional
@tailwindcss/oxide-wasm32-wasi@4.1.14 and root tslib@2.3.0. On Linux x64,
npm 11.6.2 generates a valid three-entry lockfile with the wasm package's
bundle declaration and no enumerated bundled children. After aube rewrites it,
npm treats the retained tslib: ^2.4.0 dependency as ordinary, cannot satisfy it
with root tslib 2.3.0, and rejects the lockfile:

npm error Missing: tslib@2.8.1 from lock file

The same case also includes a separate two-root fixture (whatwg-url@5.0.0
and dev data-urls@7.0.0) where aube removes valid existing placements at
node_modules/data-urls/node_modules/tr46 and
node_modules/data-urls/node_modules/webidl-conversions. npm ci accepts that
replacement layout, but native npm preserves both paths on the same add. The
native npm controls preserve the checked metadata and placements and pass
npm ci for both fixtures. I expected those existing entries to survive an
unrelated add, consistent with the
shared-lockfile workflow.

NPM_BIN=/path/to/real/npm ./repro.sh

I found the bundle failure in a private React frontend, where npm ci failed
with the same missing-tslib message after a two-package dev add. This repro
exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.1; the fork retains the
bundle declarations and nested placements, and npm ci accepts both results.

Optional: fix available

The fork change in mwolson/aube#6 npm-lock-peer-entries
preserves these existing entries.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Cases: npm-lock-nested-peer-drop, npm-lock-nested-peer-add, npm-lock-package-workspaces
• aube: 2.8.3 linux-x64 (2026-10-25) (also 2.8.2)

Three more existing-entry rewrites on an unrelated aube add is-number@7.0.0. All three use npm 11.6.2 lockfiles, and npm's own add leaves every one of these entries unchanged:

• npm-lock-nested-peer-drop: with two installed copies of ajv, aube removes "peer": true from node_modules/schema-utils/node_modules/ajv.
• npm-lock-nested-peer-add: two installed copies of picomatch carry different peer flags, and aube removes "peer": true from tinyglobby's copy. Peer flags seem to be tracked per name and version, while npm tracks them per installed path.
• npm-lock-package-workspaces: aube removes the workspaces array that npm records on an installed package's own entry (node_modules/vitefu).

None of these breaks npm ci on its own, but each turns an unrelated add into lockfile churn that npm then reverts on its next write.

AUBE_BIN=/path/to/aube NPM_BIN=/path/to/npm-11.6.2 ./npm-lock-nested-peer-drop/repro.sh

The same command runs the other two cases. Each script exits 1 on aube 2.8.3 and 0 on mwolson/aube#6 npm-lock-peer-entries, which keeps peer flags per installed path and preserves installed packages' workspaces and engines.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Fix opened in #1851: it preserves npm peer entries (per installed path), bundleDependencies, nested placements, installed-package workspaces/engines, and the nested optional orphan, based on mwolson#6. All six repro scripts fail on main and pass on the branch with npm 11.6.2.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

🤖 Generated with Claude Code

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: bun-lock-npm-bundled-optional-meta
• aube: main at 3c226195 (local release build); Bun 1.4.3 control

A small side effect of #1851: the resolver now records __aube_npm_bundled_optional on every registry package whose bundleDependencies include an optional dependency, and the bun writer copies it into bun.lock. The case serves a local registry with bundler@1.0.0 bundling inner and an optional opt:

bun 1.4.3: bundler metadata {"dependencies":{"inner":"1.0.0"},"optionalDependencies":{"opt":"1.0.0"}}
aube main: bundler metadata {"__aube_npm_bundled_optional":{"opt":"1.0.0"}}

Bun never writes the key and drops it on its next bun install; released 2.8.3 does not write it either. Adding the constant to the bun writer's skip list next to EXTRA_NPM_FUNDING (crates/aube-lockfile/src/bun/write.rs) fixes it; the fork does that in mwolson#7.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)