Fresh npm workspace install writes local dependency specs that its own frozen install rejects

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-workspace-local-dir-spec
• aube: 2.8.2 linux-x64 (2026-10-23)

A workspace member depends on host through file:../../vendor/host. Host declares leaf through an absolute local file: directory or tarball spec. A fresh aube install --no-frozen-lockfile succeeds and host can load leaf, but aube writes leaf: file+<hash> into packages["vendor/host"].dependencies instead of the manifest's file:<path>. After deleting node_modules, aube install --frozen-lockfile exits 1 with vendor/host: manifest adds leaf@file:<path>, although no manifest changed. Both source kinds reproduce it.

I expected aube to accept the lockfile it just generated. Native npm 11.6.2 preserves the declared spec, and its fresh install and clean npm ci both load leaf. The repro generates the empty seed lockfile with npm before adding the dependencies, then checks the full fresh-write-clean-frozen lifecycle using only tiny local packages. The lockfile docs list npm read/write support and describe frozen failures as manifest drift.

AUBE_BIN=/path/to/aube NPM_BIN=/path/to/real/npm ./repro.sh

I found this with independent local-package probes while validating a package-manager migration. The repro exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.2.

Optional: fix available

The fork change in mwolson/aube#10 npm-workspace-local-dir-spec
keeps the declared specs on local packages and writes them back.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the report and the fork patch. I reproduced this on main and re-landed the fix, adapted to current main, in #1855.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

🤖 Generated with Claude Code