Peer suffixes differ from pnpm for an aliased peer and for an out-of-range optional peer

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-lock-peer-suffix-shape
• aube: 2.8.2 linux-x64 (2026-10-23)

Two snapshot keys come out differently after an unrelated aube add:

typescript aliased to npm:@tsc-rs/typescript@0.8.0, ts-api-utils peers on typescript:
  pnpm 11.10.0 / 12.14.0: ts-api-utils@2.1.0(@tsc-rs/typescript@0.8.0)
  aube 2.8.2:             ts-api-utils@2.1.0(typescript@0.8.0)

ws@7.5.11 has optional peer utf-8-validate@^5.0.2, root provides utf-8-validate@6.0.6:
  pnpm 11.10.0 / 12.14.0: ws@7.5.11(utf-8-validate@6.0.6)
  aube 2.8.2:             ws@7.5.11

PNPM_BIN=/path/to/real/pnpm ./repro.sh

pnpm frozen-installs both aube lockfiles, and aube still lets ws resolve 6.0.6 at runtime, so nothing breaks. The cost is churn: in pingdotgg/t3code one aube add in apps/mobile rewrote about 1,300 lines of peer suffixes, including new expo hash suffixes that follow from these two differences.

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-lock-peer-cycle-shape
• aube: 2.8.2 linux-x64 (2026-10-23)

I reduced two more sources of peer-suffix churn beyond the alias and optional
range rules above. The cycle fixture has three tiny packages: consumer peers on
host, host peers on plugin, and plugin peers on host. The root needs only
consumer; pnpm auto-installs the providers. After an unrelated add, pnpm 11.10.0
and 12.14.0 keep cycle-consumer@1.0.0(cycle-host@1.0.0), while aube writes
cycle-consumer@1.0.0(cycle-host@1.0.0(cycle-plugin@1.0.0)). With
peersSuffixMaxLength: 1, the same difference changes the consumer hash from
pnpm's 076b888d571dde1717a49649afd28f85 to aube's
8727237358689001e387cbafa03f840a.

The second fixture uses an optional peer with versions 1 and 2 in two importer
contexts. After seeding with pnpm, it removes the member's direct peer 2
dependency while keeping that version reachable through a child. Both native
pnpm versions retain separate consumer snapshots for peer 1 and peer 2 after
the unrelated add; aube collapses them to peer 1. The runner generates the seed
locks with real pnpm and compares snapshot keys after each tool adds a tiny
package from its local registry:

PNPM_BIN=/path/to/real/pnpm ./repro.sh

These came from the remaining Expo hash and Drizzle/zod context differences in
pingdotgg/t3code after accounting for the original two rules. Both aube versions
tested preserve the native seed locks on frozen installs. Clean native pnpm
frozen installs also accept the default-cap rewrites, so this repro demonstrates
churn rather than an install failure. The forced-hash check excludes the separate
loss of settings.peersSuffixMaxLength on rewrite.

Optional: fix available

The fixture exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.1 with both pnpm
controls. The fix is in mwolson/aube #5 pnpm-lock-peer-suffix-shape.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the detailed repro. The alias and out-of-range optional peer rules are up in #1849, based on your fork PR and narrowed to those two rules. The peer-cycle and multi-version optional peer rules from your follow-up are larger changes to peer_context.rs, so they will come as separate PRs.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[jdx]

The peer-cycle rule is up in #1859 (narrowed from your fork PR: cyclic providers are written bare in consumer suffixes, including the hashed peersSuffixMaxLength case). The multi-version optional peer rule is still being looked at.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.