npm package-lock drift is treated as fresh when root dependencies changed

[YewFence]

aube install appears to treat a stale npm package-lock.json as fresh when the root dependencies in package.json changed.

In the reproduction below, package-lock.json is generated by npm from a manifest that depends on @raycast/api. Then package.json is changed to depend on @vicinae/api without updating the lockfile. I would expect aube install --lockfile-only to detect drift and re-resolve, or aube install --frozen-lockfile to fail. Instead, aube reports the lockfile as up to date.

Environment

$ aube --version
1.24.0 linux-x64 (2026-06-23)

Reproduction

Create a new directory and generate a real npm lockfile for @raycast/api.

mkdir aube-package-lock-drift-repro
cd aube-package-lock-drift-repro
cat > package.json <<'JSON'
{
  "name": "aube-package-lock-drift-repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "@raycast/api": "^1.104.13"
  }
}
JSON

npm install --package-lock-only --ignore-scripts

At this point, npm creates a real package-lock.json whose root package records @raycast/api.

{
  "packages": {
    "": {
      "dependencies": {
        "@raycast/api": "^1.104.13"
      }
    },
    "node_modules/@raycast/api": {
      "version": "1.104.20",
      "dependencies": {
        "@types/node": "22.19.17",
        "@types/react": "19.0.10",
        "react": "19.0.0"
      }
    }
  }
}

Then change only package.json to use @vicinae/api.

{
  "name": "aube-package-lock-drift-repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "@vicinae/api": "^0.21.5"
  }
}

Run this command with the stale npm lockfile still present.

aube install --lockfile-only

Actual behavior

Lockfile is up to date, resolution step is skipped

The lockfile is treated as fresh even though the manifest dependency is @vicinae/api and the lockfile root dependency is @raycast/api.

Expected behavior

aube install --lockfile-only should detect that the npm lockfile root dependency snapshot does not match package.json and should re-resolve the lockfile.

aube install --frozen-lockfile should fail with a stale lockfile error for the same mismatch.

Workaround

aube install --fix-lockfile does repair this case.

aube install --fix-lockfile --ignore-scripts

After running that command, package-lock.json is updated so that packages[""].dependencies contains @vicinae/api and no longer contains @raycast/api.

The wording above was refined with AI translation/editing, but all testing and observations were performed by me.

[jdx]

Thanks for the clear repro. I opened PR #974 to fix this.

The fix preserves root dependency specifiers from npm package-lock.json entries, so the existing drift checker can now see when package.json has moved from @raycast/api to @vicinae/api. With that, aube install --lockfile-only should re-resolve instead of reporting the stale lockfile as fresh, and aube install --frozen-lockfile should fail on the mismatch.

I also added regression coverage for the reported case.

This comment was generated by Codex.