aube add drops a nested optional npm lockfile entry that npm keeps, so npm ci fails

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-optional-orphan
• aube: 2.8.3 linux-x64 (2026-10-25) (also 2.8.2)

The fixture's package-lock.json was written by npm 11.6.2. It declares @emnapi/core, @napi-rs/wasm-runtime and the optional @rolldown/binding-wasm32-wasi, then updates @emnapi/core from 1.10.0 to 1.11.2 with npm itself. That npm update leaves a nested optional entry, node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/wasi-threads@1.2.1, that no resolved dependency edge reaches any more.

An unrelated aube add is-number@7.0.0 removes that entry, and npm 11.6.2 then rejects the lockfile:

npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync.
npm error Missing: @emnapi/wasi-threads@1.2.1 from lock file

npm 11.6.2's own npm install is-number@7.0.0 --package-lock-only leaves the entry unchanged, and its npm ci passes.

AUBE_BIN=/path/to/aube NPM_BIN=/path/to/npm-11.6.2 ./npm-lock-optional-orphan/repro.sh

I found this in a private npm project with 685 lockfile records, where a two-package dev add made the result unusable for npm ci. The reduced case has three declared packages and no hand-edited lockfile entries. The script exits 1 on aube 2.8.3 and 0 on the fork build below.

Optional: fix available

mwolson/aube#6 npm-lock-peer-entries carries such an entry on its owning package when reading the lockfile. It writes the entry back only if the owner keeps the same identity, path and dependency signatures, and it drops the entry again if any live dependency would resolve to it through Node's lookup.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Fix opened in #1851: it preserves npm peer entries (per installed path), bundleDependencies, nested placements, installed-package workspaces/engines, and the nested optional orphan, based on mwolson#6. All six repro scripts fail on main and pass on the branch with npm 11.6.2.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

🤖 Generated with Claude Code