package-lock.json writes an absolute directory target key that npm ci rejects

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-absolute-dir-key
• aube: 2.8.2 linux-x64 (2026-10-23)

With a direct dependency such as "child": "file:/absolute/path/to/project/child", aube installs successfully but writes the absolute filesystem path as the linked target's packages key and as node_modules/child.resolved. A subsequent clean npm ci fails with EUSAGE. This needs only one dependency with no dependencies of its own.

npm 11.6.2 keeps the absolute manifest specifier, but writes "child" as both the target key and the link's resolved, with "link": true. If the target is outside the project, it uses "../child". npm's fresh install and clean npm ci both pass. The repro also checks a clean frozen aube reload before trying npm against aube's lockfile.

AUBE_BIN=/path/to/aube NPM_BIN=/path/to/real/npm ./repro.sh

I found this while checking local directory children of a tarball dependency during package-manager migration testing. The direct-directory reduction needs no tarball parent: the repro exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.2.

Optional: fix available

The fork change in mwolson/aube#15 npm-lock-absolute-dir-key
writes npm's root-relative target key and resolved, keeping the absolute manifest spec.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the repro. #1853 writes the npm root-relative target key and resolved for absolute directory specs, adapted from your fork patch (co-authored). Nested deps of a directory target are not part of that change.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1853: fix(lockfile): write absolute npm directory targets as relative keys