Relocated lockfile guard rejects workspace members and native npm/Bun roots

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: lockfile-dir-workspace-importers
• aube: 2.8.2 linux-x64 (2026-10-23)

A workspace with apps/app runs aube install --lockfile-dir=locks --no-frozen-lockfile. The install succeeds and writes an aube/pnpm lockfile, but after deleting the installed modules, aube install --lockfile-dir=locks --frozen-lockfile exits 11: lockfile already records importers from other projects (apps/app). No manifest changed. Independently, moving a native npm or Bun lockfile into locks/ makes the first aube frozen install reject its implicit . root as foreign to the project's relative importer key ...

I expected a relocated lockfile to remain usable for the project and its workspace members. Native pnpm 12.14.0 passes the workspace fresh-write and clean-frozen lifecycle, recording the member as ../apps/app. The settings docs direct shared projects to a workspace, while the lockfile docs promise format preservation. The repro checks these failures separately using only is-number@7.0.0, checks runtime loading, and verifies frozen lockfile bytes are unchanged. npm 11.6.2 and Bun 1.4.3 generate the native-format fixtures.

AUBE_BIN=/path/to/aube PNPM_BIN=/path/to/real/pnpm \
    NPM_BIN=/path/to/real/npm BUN_BIN=/path/to/real/bun ./repro.sh

I found this in local workspace and lockfile-relocation probes while validating a package-manager migration. I searched the discussions and PRs for lockfile-dir and found the original relocation and foreign-root guard changes, but no report of these two failures. The repro exits 1 on upstream 2.8.2 and 0 on 2.8.2+mwolson.3.

Optional: fix available

The fork change in mwolson/aube#18 lockfile-dir-workspace-importers writes every aube/pnpm importer relative to the lockfile directory and accepts paths inside the workspace even when members have been removed, renamed, or excluded. It preserves native npm/Bun root and member conventions without adding ownership metadata, rejects a different project's manifest in the lock directory, and documents that native-format ownership protection is best-effort. Relocated Bun local versions are read once from the project root. Older relocated workspace lockfiles with mixed coordinates migrate on the next normal install. Frozen installs that require this repair report guidance to regenerate the lockfile.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the report and the fork patch. This is now up for review as #1856 (re-landed on current main, crediting @mwolson as co-author). Reproduced the exit-11 frozen install on main; it passes with the change.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.