aube add drops pnpm 12 lockfile metadata, breaking frozen installs with a custom peersSuffixMaxLength

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: pnpm-lock-rewrite-metadata
• aube: 2.8.2 linux-x64 (2026-10-23)

Starting with a pnpm 12.14.0 lockfile and peersSuffixMaxLength: 80 in pnpm-workspace.yaml, an unrelated aube add is-sorted@1.0.5 succeeds but removes settings.peersSuffixMaxLength from pnpm-lock.yaml. A clean pnpm install --frozen-lockfile --ignore-scripts then rejects it with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH, saying that settings.peersSuffixMaxLength does not match the configuration.

The same fixture has one local tarball containing a bundled is-number@7.0.0. The rewrite also drops that package entry's version, resolution.integrity, and bundledDependencies: [is-number], and adds a separate registry package and snapshot dependency for the bundled child. Real pnpm 12.14.0 add is-sorted@1.0.5 --save-exact --lockfile-only --ignore-scripts keeps all of that metadata and its lockfile passes a clean frozen install. I expected aube to preserve the existing pnpm metadata too; the repro generates the seed with pnpm rather than hand-editing a lockfile.

Run from the case directory with a real pnpm 12.14.0 binary:

PNPM_BIN=/path/to/real/pnpm ./repro.sh

This came from an unrelated dependency addition in pingdotgg/t3code's apps/mobile workspace. The repro reduces it to a local tarball, its tiny bundled child, and one dependency-free registry addition.

Optional: fix available

The fork fix is in mwolson/aube PR #4 pnpm-lock-rewrite-metadata. The same repro passes with 2.8.2+mwolson.1 linux-x64 (2026-10-24), including clean frozen installs with both pnpm and aube.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the detailed report and repro. I could reproduce this on main and opened #1857 with a narrowed version of your fix (credited to you via Co-authored-by). It keeps extra settings: entries such as peersSuffixMaxLength. It also keeps a local tarball's version, integrity and bundledDependencies, and stops resolving its bundled children from the registry.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1857: fix(lockfile): keep pnpm settings and local tarball metadata on rewrite