npm package-lock repair omits a direct package entry

[mwolson]

I can reproduce this with aube 1.13.1 linux-x64 (2026-05-14).

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-missing-entry

Steps:

cd npm-lock-missing-entry
./repro.sh

The checked-in package.json has expo-router as a direct dependency, while the checked-in package-lock.json is intentionally stale and lacks expo-router in both:

• packages[""].dependencies
• packages["node_modules/expo-router"]

Expected:

• aube install --fix-lockfile should add packages[""].dependencies["expo-router"].
• aube install --fix-lockfile should add packages["node_modules/expo-router"].

Actual:

• aube adds the root dependency spec.
• aube does not add packages["node_modules/expo-router"].
• A follow-up aube ci succeeds but omits node_modules/expo-router.

This came from retesting a larger Expo/React Native app where typecheck then fails with missing expo-router imports after the clean frozen install.

[jdx]

Thanks for the repro. I traced this to npm package-lock writing for dep paths whose peer context has been hashed, e.g. expo-router@4.0.22_94c00fd028.

The writer already canonicalized parenthesized peer suffixes like pkg@1.0.0(peer@1.0.0), but it did not canonicalize the hashed _xxxxxxxxxx form. That meant the fixed graph had the direct dep and linked it into node_modules, but the npm writer skipped the matching packages["node_modules/expo-router"] entry because it could not map the hashed dep path back to expo-router@4.0.22.

Opened a fix here: #697

Validation on the fixture:

• aube install --fix-lockfile --ignore-scripts --reporter append-only
• confirmed packages[""] .dependencies["expo-router"] == "~4.0.21"
• confirmed packages["node_modules/expo-router"] exists with version 4.0.22

This comment was generated by Codex.

[mwolson]

Thanks for looking into these! I'm a bit late with this one, but in case it's helpful I updated the repro case to trim the package.json dependencies list to just the minimum set.

[mwolson]

I've verified the fix in aube 1.14.1