'aube add' drops patch_hash from patched dependencies in the lockfile

[mwynholds]

Title: aube add drops patch_hash from patched dependencies in the lockfile

Version: aube 2.2.13 macos-arm64 (2026-09-09), Node 24.19.0, macOS 15.6

Summary: In a workspace with patchedDependencies in aube-workspace.yaml, any aube add — of an unrelated package, in any workspace member — rewrites aube-lock.yaml with the patched dependency's (patch_hash=…) suffix removed from both its importer entry and its snapshot key. aube install leaves the lockfile alone and still applies the patch afterwards, so the result is lockfile drift on every add rather than an unpatched install.

Repro: aube-workspace.yaml with packages: [server, web] and patchedDependencies: { '@modelcontextprotocol/sdk@1.30.0': patches/@modelcontextprotocol__sdk@1.30.0.patch }; server/ depends on the SDK, web/ does not. aube install → lockfile carries the hash. cd web && aube add -D tiny-invariant@1.3.3 → git diff aube-lock.yaml shows, beyond the expected lines:

-        version: 1.30.0(patch_hash=4f7f9eb2…)(zod@4.5.4)
+        version: 1.30.0(zod@4.5.4)
-  '@modelcontextprotocol/sdk@1.30.0(patch_hash=4f7f9eb2…)(zod@4.5.4)':
+  '@modelcontextprotocol/sdk@1.30.0(zod@4.5.4)':

Same from cd server && aube add …. A plain aube install does not change the lockfile.

Expected: add preserves the patch_hash on entries covered by patchedDependencies, as install writes them.
Actual: removed on every add. Restoring it by hand and running aube install --frozen-lockfile is accepted ("Already up to date"), so both forms are treated as equivalent and CI never notices.

Notes: installs stay patched either way (virtual-store path …zod@4.5.4-d7d2aa2b… without the hash, patched content inside; a fresh install from the hash-carrying lockfile lands at …_patch_hash=4f7f9eb2… with the same content). Impact is a spurious two-line lockfile change on every add that reviewers must recognise and revert, and a lockfile that no longer records the patch.

[jdx]

Thanks for the detailed repro. The fix is in aubepkg/aube#1577.

Cause: the lockfile writer only added (patch_hash=…) when the file was named pnpm-lock.yaml. For aube-lock.yaml it passed through whatever was already in the parsed entries. Your lockfile likely got its hashes from aube import of a pnpm lockfile (or a renamed pnpm-lock.yaml), and those survive a plain aube install. aube add re-resolves and builds new entries with no hash, so they were dropped.

After the fix: aube-lock.yaml always records patch hashes the same way pnpm-lock.yaml does, so install, add and import all produce the same output. aube add no longer touches the patched entries.

Upgrading: projects whose aube-lock.yaml has no hashes yet still pass --frozen-lockfile unchanged. The next non-frozen install or add records the hashes, which is a one-time lockfile diff. Your lockfile already has them, so you should see no diff on add once this ships.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: unavailable.

[jdx]

good to hear from you mike!

[mwynholds]

i've been following your journey to being a full time CLI and dep manager builder, and am a fan and user of your tools. congrats!

…

On Tue, Sep 22, 2026 at 11:56 AM jdx ***@***.***> wrote: good to hear from you mike! — Reply to this email directly, view it on GitHub <#13456?email_source=notifications&email_token=AABJBRIY43MTWVGO2THI24D5QLDOLA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCOBVGU3TIOJVUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-18557495>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABJBROQDF2Y2DHMADR6SWL5QLDOLAVCNFSNUABIKJSXA33TNF2G64TZHM2TQNRZGIYDIMJUHNCGS43DOVZXG2LPNY5TCMBYGYYTCNRVUF3AE> . You are receiving this because you authored the thread.Message ID: ***@***.***>