Hoisted monorepo: identical deps become separate realpaths per workspace package

[mwolson]

Summary

In a small workspace monorepo, under node-linker=hoisted (or
AUBE_NODE_LINKER=hoisted), aube materializes the same resolved dependency
as separate real directories under each workspace package. Content can be
byte-identical (and individual files may even share inodes via hardlinks) while
the package-root realpath still differs. Node and bundlers then treat those as
multiple module instances.

Under aube isolated, importers share one physical instance via the virtual
store and symlinks.

Minimal public repro (aube 1.37.0, exits 1 when the hoisted realpaths differ):

• https://github.com/mwolson/tmp-aube-issues/tree/main/hoisted-workspace-shared-dep-realpath

cd hoisted-workspace-shared-dep-realpath
./repro.sh

We hit this while using hoisted installs so Metro / Expo could see in-tree
package slots on a larger monorepo. Isolated is better for module identity;
hoisted is better for that tooling. Curious whether a middle ground is ever in
scope, or whether the intended guidance is simply isolated (or another package
manager) for this class of project. Totally fine if the answer is "out of
scope."

Observed on the repro (aube 1.37.0)

Two workspace packages (@repro/app, @repro/lib) both depend on
is-number@7.0.0.

Linker	packages/*/node_modules/is-number	Same realpath?
Isolated	Symlinks into node_modules/.aube/is-number@7.0.0/...	Yes
Hoisted	Real directories under each package (not symlinks)	No

On the hoisted install we also saw matching inodes for some files inside those
trees (store hardlinks), but the package root paths still differ, which is what
resolution uses.

package-import-method looks like it controls store import, not "one package
root path shared across workspace importers in hoisted mode." We may simply be
missing a setting.

Why it came up for us

On a larger Expo monorepo, hoisted install produced many physical copies of the
same pinned dependency under each workspace package (e.g. several
node_modules/effect trees). A Metro sourcemap listed multiple
node_modules/effect package roots in one app bundle. Some libraries care about
process-wide singleton modules (module path identity, not only version).

No need to dig into that app here; the tiny is-number workspace is enough to
show the layout difference.

Ideas that might help (not requests)

If this is something you would ever want to support, things that would have
helped include:

1. Under hoisted, when linking the same integrity/version into multiple
   workspace node_modules/<pkg> slots, expose one package-root realpath
   (symlink or equivalent) instead of distinct real directories, even if file
   contents are already hardlinked.
2. A hybrid layout that stays in-tree for tools but keeps a single realpath per
   resolution key.
3. Docs on the recommended Expo monorepo path if the answer is "prefer isolated
   plus some Metro configuration."

If hoisted is intentionally npm-like separate package roots per workspace
package, that is useful to know so we can stop expecting path identity there.

Questions

1. Is multi-root layout under hoisted intentional for workspaces, or just how
   the current linker landed?
2. Would shared package-root identity across workspace importers ever be in
   scope for hoisted mode?
3. For Expo monorepos, is isolated plus Metro config the recommended path, and
   is that documented?

No expectation of a feature from this; a short "won't do / use isolated" would
already help. Happy to adjust the repro if a different shape would be more
useful.

[jdx]

Thanks for the detailed repro. I confirmed this is a pnpm-compatibility bug rather than an intentional limitation and opened #1243 with a fix.

The root cause was that aube planned a separate hoisted tree for every workspace importer. That made cross-importer sharing impossible and also made the default hoistingLimits=none behave like workspaces.

The fix plans one workspace-wide tree. With the default none, compatible dependencies now hoist to one physical package at the workspace root; workspaces still keeps a separate package root under each importer, and version or peer-context conflicts remain nested where needed.

One nuance for the repro: after this change, packages/app/node_modules/is-number and packages/lib/node_modules/is-number are intentionally absent, matching pnpm hoisted layout. Both importers resolve upward to the same root node_modules/is-number. A require.resolve(..., { paths: [...] }) comparison is therefore the best identity assertion.

I verified the supplied fixture with the patched binary: both importer-based resolutions return the same realpath.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[mwolson]

Retested the minimal repro with aube 1.38.1. hoisted-workspace-shared-dep-realpath/repro.sh now passes: under --node-linker=hoisted, both workspace importers resolve is-number to the same workspace-root realpath via require.resolve(..., { paths }), and package-local node_modules/is-number slots are absent as expected. The fix shipped in PR #1243 share hoisted deps across workspace importers. The repro index is updated at https://github.com/mwolson/tmp-aube-issues/tree/main/hoisted-workspace-shared-dep-realpath.