Summary

When package.json contains a non-empty overrides block, aube install rewrites package-lock.json in a way that:

• strips optional: true markers (and matching os / cpu constraints) from platform-specific packages,
• prunes those platform-specific package entries entirely from the packages section,
• collapses peerDependencies into concrete dependencies with pinned versions.

The content of overrides does not matter — even an override on a package with no peer chains (e.g. lodash) triggers it. An empty overrides: {} does not trigger it.

Environment

• aube 1.15.0 macos-arm64 (2026-05-17)
• node v24.14.1, npm 11.11.0

Minimal reproduction

package.json:

{
  "name": "aube-overrides-repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "typescript": "^5.0.0",
    "vite": "^8.0.13",
    "react": "18.3.1",
    "@casl/react": "5.0.1",
    "@casl/ability": "6.8.1"
  },
  "overrides": {
    "lodash": "^4.0.0"
  }
}

npm install --package-lock-only --ignore-scripts --no-audit --no-fund
cp package-lock.json package-lock.npm.json
aube install --ignore-scripts
diff -q package-lock.npm.json package-lock.json

Actual

Files package-lock.npm.json and package-lock.json differ

The pruned packages are all @esbuild/* platform binaries, including the one matching the host (@esbuild/darwin-arm64). @casl/react gains injected concrete dependencies:

 "node_modules/@casl/react": {
   "version": "5.0.1",
   ...
+  "dependencies": {
+    "@casl/ability": "6.8.1",
+    "react": "18.3.1"
+  },
   "peerDependencies": {
     "@casl/ability": "^4.0.0 || ^5.1.0 || ^6.0.0",
     "react": "^17.0.0 || ^18.0.0 || ^19.0.0"
   }
 }

Expected

aube install on a package-lock.json written by npm should round-trip the file faithfully. The overrides block should not change the shape of packages[], optional/os/cpu metadata, or peer/dep classification of unrelated packages.

Ablation

The trigger is the presence of any entry in overrides — neither the npm $<direct-dep> parent-reference syntax nor a specific override target is required.

This issue was investigated with Claude Code.