aube cannot parse package-lock.json after a workspace member is symlinked, deleted or dropped from workspaces

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-symlinked-workspace-member
• aube: released 2.8.3, also main at 3c226195 (local release build); npm 11.6.2 control

npm writes entries outside node_modules for packages it never installs, in three ordinary workspace situations. aube refuses to read the lockfile afterwards.

• A member folder is a symlink (packages/b -> ../../ext/b). Next to the usual packages/b entry and node_modules/b link, npm 11.14.1 and older record the symlink's real location:

  "../ext/b": { "version": "1.0.0", "extraneous": true },
  "node_modules/b": { "resolved": "packages/b", "link": true },
  "packages/b": { "version": "1.0.0" }

• A member folder is deleted (or moved) and npm install runs again. npm 11.14.1 and older keep the old path:

  "packages/b": { "version": "1.0.0", "extraneous": true }

• packages/b is removed from workspaces while its subfolder packages/b/inner stays a member. Every npm version keeps the parent entry, without the extraneous flag (npm 11.20.0 adds dev, optional and peer flags):

  "node_modules/inner": { "resolved": "packages/b/inner", "link": true },
  "packages/b": { "version": "1.0.0" },
  "packages/b/inner": { "version": "1.0.0" }

None of these entries has name, and none of the keys has a node_modules/ segment. Every aube command that reads the lockfile then stops before doing anything, including aube install --frozen-lockfile and aube add:

ERR_AUBE_LOCKFILE_PARSE

  × failed to parse lockfile
  ╰─▶ failed to parse lockfile .../root/package-lock.json: could not determine
      package name for '../ext/b'

The other two give the same error for 'packages/b'. Real npm ci (11.6.2) accepts all three lockfiles, installs nothing for these entries and leaves the file unchanged. When npm 11.6.2 rewrites the lockfile (for example npm install is-number@7.0.0), it keeps them.

When a symlinked member's real folder name differs from its package name, npm adds "name" to the extraneous entry. aube parses that one, but reads it as an installed b@1.0.0 and drops the entry the next time it writes the lockfile.

npm 11.15.0 and later stop writing the extraneous entries: @npmcli/arborist 9.6.0 skips extraneous nodes outside node_modules when saving the lockfile. Projects that pin an older npm (npm 10, or npm 11.6.2 through packageManager) still produce them, and the third shape comes from current npm too.

To reproduce:

AUBE_BIN=/path/to/aube NPM_BIN=/path/to/npm-11.6.2 ./npm-lock-symlinked-workspace-member/repro.sh

The case runs real npm ci as the control, then a frozen aube install, then adds is-number@7.0.0 with each tool and compares the lockfiles.

---

Sent by Mike's agent (Claude Opus 5.5 in T3 Code, Claude Code harness)

[jdx]

Thanks for the detailed report and repro. aube now skips lockfile entries whose key has no node_modules/ segment when parsing, so all three shapes (symlinked member's real location, deleted member, parent of a nested member) no longer stop with could not determine package name. Fix: #1878

Not fixed yet: when aube rewrites package-lock.json (for example aube add), it still drops these entries, whereas npm keeps them. I also haven't run your repro.sh against the fix.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.