Tarball dependencies cannot resolve absolute file: children even with exotic subdependencies allowed

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Cases: tarball-transitive-local-dep, bun-lock-absolute-dir-ident
• aube: 2.8.2 linux-x64 (2026-10-23)

The root depends on a local host.tgz. Its manifest depends on another local tarball using an absolute file: path. With block-exotic-subdeps=false in .npmrc, a fresh install still fails:

transitive local specifier file:<absolute-path>/child.tgz cannot be resolved without the parent package source root

pnpm 12.14.0, npm 11.6.2, and Bun 1.4.3 install the same absolute tarball dependency successfully. An absolute path should not require a parent source root. The settings docs describe the exotic-source block as configurable, and this repro explicitly disables it. Relative child paths are a separate question: pnpm and Bun interpret them from the project root, while npm interprets them beside the parent tarball.

PNPM_BIN=/path/to/real/pnpm ./repro.sh

I found this while probing a local tarball dependency tree with two React versions. The reduced case needs only host and child, with no registry packages or peers. The script generates the tarballs with the current absolute path, verifies pnpm fresh and clean frozen installs, then checks the same lifecycle with aube. It exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.2.

Once that resolves, a directory child exposes a second problem in the bun.lock writer. aube writes "child@file:/absolute/path/to/project/assets/child" as the folder identifier, and a clean bun install --frozen-lockfile --linker=hoisted rejects it as an unsafe folder path. Bun's own lockfile uses "child@file:assets/child" and keeps the absolute spec in the parent's metadata. The bun-lock-absolute-dir-ident case covers this; it fails on upstream 2.8.2 at the resolution step above, since the writer path is unreachable until then.

AUBE_BIN=/path/to/aube BUN_BIN=/path/to/real/bun ./repro.sh

Optional: fix available

The fork changes in mwolson/aube#14 tarball-transitive-local-dep
allow absolute child paths while keeping the exotic-source setting and the rejection of unanchored relative paths, and
mwolson/aube#16 bun-lock-absolute-dir-ident
writes Bun folder identifiers relative to the lockfile.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the detailed repro. Two PRs, one per problem:

• fix(resolver): resolve absolute local children of tarball dependencies #1852 — absolute file: children of a tarball now resolve without a parent source root.
• fix(lockfile): write bun folder identifiers relative to the lockfile #1854 — bun.lock folder identifiers are written relative to the lockfile.
  Both are adapted from your fork patches (co-authored).

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1852: fix(resolver): resolve absolute local children of tarball dependencies

[github-actions[bot]]

Implemented in #1854: fix(lockfile): write bun folder identifiers relative to the lockfile

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: tarball-transitive-local-dep
• aube: main at 3c226195 (local release build); pnpm 12.14.0 control

Thanks for #1852. The fresh install passes on current main, but the case's second step still fails: after removing node_modules, aube install --frozen-lockfile from the aube-lock.yaml aube just wrote leaves host without its child link (Cannot find module 'child'), with the lockfile unchanged. pnpm passes both steps.

#1852 matches the fork's resolver change; the frozen half came from another fork layer. Bisecting the fork, it is in mwolson#4: on lockfile reload it keys transitive file: packages by their canonical local key and resolves the preserved file: edges against the actual graph keys in the linker, hoisting and graph hashing. #1857 merged without that part, and the frozen step still fails on main.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)