aube licenses command groups all deps under UNKNOWN when using nodeLinker = "hoisted"

[marcospereira]

Reproducer: https://github.com/marcospereira/aube-licenses-cmd

It happens with 1.33.1, 1.34.0 and 1.35.0.

Didn't test with older versions of Aube.

When removing nodeLinker = "hoisted" from .config/aube/config.toml, it works as expected:

rm -rf node_modules && mise run install-deps && mise run licenses
[install-deps] $ aube install
aube 1.35.0 by jdx.dev  [==============================================================================================================================================================================]    5/5 pkgs
dependencies:
+ @fastify/cors@11.3.0
+ bcryptjs@3.0.3
+ drizzle-orm@0.45.2

[licenses] $ aube licenses
├─ Apache-2.0
│  └─ drizzle-orm@0.45.2
├─ BSD-3-Clause
│  └─ bcryptjs@3.0.3
└─ MIT
   ├─ @fastify/cors@11.3.0
   ├─ fastify-plugin@6.0.0
   └─ toad-cache@3.7.4

[jdx]

Thanks for the reproducer. Confirmed: aube licenses always derived paths from the isolated virtual store, but a hoisted install places packages directly in the real node_modules tree, so every manifest read fell back to UNKNOWN.

I opened draft PR #1183 with a fix: #1183

The fix uses the layout recorded by the completed install (including a one-shot --node-linker=hoisted override), reconstructs the actual hoisted placements from the full graph, and adds regression coverage for both root and nested hoisted dependencies. The focused unit tests, licenses BATS suite, formatting, and Clippy all pass.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.