Frozen npm lockfile reload succeeds but a linked directory cannot load its local tarball dependency

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-linked-dir-tarball-child
• aube: 2.8.2 linux-x64 (2026-10-23)

A non-workspace root depends on host through file:vendor/host. Host declares leaf through an absolute local tarball spec and exports require("leaf"). A fresh aube install --no-frozen-lockfile writes package-lock.json and loads leaf successfully. After deleting node_modules, aube install --frozen-lockfile exits 0 and leaves the lockfile byte-identical, but requiring host fails with MODULE_NOT_FOUND: Cannot find module 'leaf' from the live vendor/host/index.js directory.

I expected the clean frozen install to keep host's declared dependency reachable. Native npm 11.6.2 installs the same fixture and loads leaf after both its fresh install and clean npm ci. The repro generates its seed lockfile with npm before adding the dependencies; both packages are tiny local fixtures. The layout docs say transitive dependencies are linked next to the packages that declare them.

AUBE_BIN=/path/to/aube NPM_BIN=/path/to/real/npm ./repro.sh

I found this with independent local-package probes while validating a package-manager migration. The repro exits 1 on upstream 2.8.2 (the install succeeds and the runtime check fails) and 0 on 2.8.2+mwolson.2.

Optional: fix available

The fork change in mwolson/aube#11 npm-linked-dir-tarball-child
links the dependency trees of file-linked importers at their live sources, as npm does.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Reproduced on current main (2.8.3) without any other fix: the frozen install leaves vendor/host without its leaf dependency. A narrowed version of the fork change is up in #1848, with a linker test; your repro passes with it. Thanks for the report and patch.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[mwolson]

Confirmed fixed in 2.8.4 linux-x64 (2026-10-27): npm-linked-dir-tarball-child/repro.sh in https://github.com/mwolson/tmp-aube-issues now passes, including its controls. Shipped in #1848. Thanks!

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)