[jdx]

https://entire.com/gh/aubepkg/-/trails/209/changes/aube/209

A local tarball dependency whose manifest declares another local package by absolute path could not be installed, even with the exotic-subdependency block turned off:

# .npmrc
block-exotic-subdeps=false

// host.tgz → package.json
{ "name": "host", "version": "1.0.0", "dependencies": { "child": "file:/abs/path/child.tgz" } }

Before: aube install failed with transitive local specifier file:/abs/path/child.tgz cannot be resolved without the parent package source root. A tarball parent has no source directory, and the guard demanded one for every path-backed child.

After: absolute file:/link: children resolve without a parent source root (pnpm, npm and Bun accept the same layout). The exotic-source policy still runs first, so the default block-exotic-subdeps=true still blocks it, and relative paths with no anchor are still rejected, since package managers disagree on their base.

Validation: new resolver unit tests cover directory and tarball absolute children, the default block, and relative-path rejection; cargo test -p aube-resolver passes; fmt and clippy clean for the touched crates. Not run: full bats suite. Reported in discussion #1830; patch adapted from mwolson#14.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 8 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: aubepkg/aube
• Branch: fix/resolver-absolute-local-children
• File: .coderabbit.yaml
• Commit: 33753cc
• Layers: Repository YAML (base), Central YAML (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1d74d50f-f6db-427c-b618-1cc46ccd0db3

Commits

Reviewing files that changed from the base of the PR and between 9c9f365 and 33753cc.

Files selected for processing: 2

• crates/aube-resolver/src/resolve/driver.rs
• crates/aube-resolver/src/tests.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Allows absolute local children of tarball dependencies to resolve without a parent source directory.

• Absolute local children resolve even when their parent has no source folder.

No actionable issues found. Tests were inspected but not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(resolver): resolve absolute local ch..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
graph	▁▁▁▁▄▄▁▁█▆▆▆▆█▆▆	13,345,084 → 13,353,489	+0.06%	6.66 → 6.77ms	+1.67%
install	▁▁▁▁▁▁▁▁▂▂██████	118,906,230 → 118,935,990	+0.03%	41.94 → 41.21ms	-1.73%
run	▃▂▂▃▃▂▁▄▄▃▁▃▃▃▄█	2,949,484 → 2,964,981	+0.53%	5.65 → 5.83ms	+3.05%
startup	▂▁▂▂▂▁▂▂▂▂▁▂▃▃▃█	2,332,006 → 2,342,276	+0.44%	3.90 → 3.75ms	-4.07%
tree	▃▃▁▁▁▄▁▁▅▅█▅▅▅▅█	12,678,000 → 12,767,490	+0.71%	6.53 → 6.36ms	-2.58%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{33753cc75d5c vs 9c9f3653c315 · measured on the runner, not pushed to the history.}