[BUG] npm install removes linked packages, npm link replaces linked package contents

[yandodov]

I have specified a package in my package.json that I have also linked with a local version I use for development. When I run npm i in the parent package, the symlink is removed, the package is installed from npm, and I use the live version instead, not my local development one.

Later, if I run npm link, the package correctly get linked with my local version, but everything is replaced with the downloaded version, meaning that all my local development files are replaced with the contents of the tarball downloaded from npm. This means I have to go in my package folder, clone the repo again, checkout the files from the master branch... Not to mention that if I have any unsaved work, it would get completely erased with no chance to get it back even via Git - because the .git folder is also deleted.

Current Behavior:

• running npm i removes linked packages and installs their published versions instead
• running npm link <package> replaces the contents of the symlinked package folder with the published package's tarball contents

Expected Behavior:

• running npm i should ignore packages in node_modules that are symlinked
• running npm link <package> should only create a symlink and leave everything in the symlinked folder intact

Steps To Reproduce:

1. Install a package from npm in a project
2. Run npm link in a different, local version of the package
3. Run npm link <package> in the project
4. Run npm i
5. Linked package is removed
6. Run npm link <package> in the project
7. Local version is replaced with the published tarball contents

Environment:

• OS: Microsoft Windows 10 Pro, 10.0.18363 Build 18363
• nvm: 1.1.7
• Node: 15.4.0
• npm: 7.0.15 (can't install 7.2 due to nvm)

[jeremy-coleman]

Yikes, thats scary.

[ljharb]

@hdodov in what way would nvm prevent npm install -g npm@7? edit: ah, i see you're using nvm-windows, not actual nvm.

[darcyclarke]

@hdodov can you install the latest v7 & try reproducing this? (ie. npm i -g npm@7)

[yandodov]

@darcyclarke I can't reach the point of being able to reproduce. With a fresh install of Node 15.8.0 and npm 7.5.1, I create a symlink by running npm link in the package folder:

added 1 package, and audited 4 packages in 231ms

...which creates the symlink (oblik). However, when I open it, it seems to be broken:

...and indeed if I try to run npm link oblik in a project, I get:

npm ERR! code ENOENT
npm ERR! syscall open
npm ERR! path C:/Program Files/nodejs/node_modules/oblik/package.json
npm ERR! errno -4058
npm ERR! enoent ENOENT: no such file or directory, open 'C:\Program Files\nodejs\node_modules\oblik\package.json'    
npm ERR! enoent This is related to npm not being able to find a file.
npm ERR! enoent

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\dodov\AppData\Local\npm-cache\_logs\2021-02-04T07_50_48_106Z-debug.log

Here's the log: 2021-02-04T07_50_48_106Z-debug.log.

---

I tried to link and unlink several times, but nothing seems to fix it. I guess that's for another issue, though? Let me know if I should open a new one. Maybe there's some issue with nvm for Windows? Although I had no issues with it specifically.

[darcyclarke]

@hdodov good to hear the initial issue seems to be resolved. I have heard of other folks using nvs or volta on Windows for version management (there's also nvm-windows, not sure if that's what you're using already, but I'm not sure how well it's supported) - could you maybe try one of those & see if linking breaks there as well?

[yandodov]

@hdodov good to hear the initial issue seems to be resolved.

@darcyclarke actually, I don't know if it's resolved. That was my point in my previous comment - I couldn't get past the npm link <package> part to see what the npm install after it would do - whether the link would stay or my child project would get erased.

I'll experiment with other version management tools and post the update here. 👍

[yandodov]

I installed Volta 1.0.1 and I didn't have the problems mentioned in my previous comment. I tried to reproduce the issue and it seems that it's half solved. Here's what I tested:

1. npm link oblik (without the package in my package.json): adds the package as a link
2. npm i: removes the linked package (maybe not expected?)
3. npm i oblik: adds the package from npm and lists it in package.json
4. npm link oblik: changes the package from the downloaded version to the local one via symlink
5. npm i: changes the package from the linked version to the downloaded one, even though it's listed in package.json (not expected)

Basically, whenever I run a command that installs or uninstalls a package, the linked package is switched with the downloaded version if it's listed in package.json, or the link is simply removed if it isn't listed.

What's different this time is that my child package (the one I'm linking) didn't get erased at any point during the testing, which is wonderful. The only real issue now is that I have to run npm link <package> every time my dependencies change.

OS: Microsoft Windows 10 Pro, 10.0.18363 Build 18363
Volta: 1.0.1
Node: 15.8.0
npm: 7.5.1