[Tracking] install-strategy=linked (isolated mode) bugs #9608

Overview

install-strategy=linked (the isolated / RFC-0042 install mode) is experimental. We ran an exhaustive behavioral sweep of the linked strategy and compared every scenario against the hoisted strategy as the oracle — any divergence is treated as a defect. This is the umbrella issue for the discrepancies that sweep confirmed; each one is tracked in a sub-task (or an existing issue, where one already applies).

Scope covered

• Dependency types/sources: registry (range/exact/tag/prerelease), scoped, git, remote/registry tarball URLs, file:/local, bundled, aliased, peer/optional, overrides.
• Graph shapes: diamonds, conflicting versions, deep/transitive chains, peers and optional peers.
• Commands: install, ci, uninstall, update, dedupe, prune, outdated, fund, rebuild, pkg, ls, query, explain, exec/npx, run, link, audit, sbom, patch.
• Configs: allow-scripts/allow-remote/allow-git, --strict-allow-scripts, --omit/--include, workspace filters (-w, --workspaces=false, --include-workspace-root), ignore-scripts, strategy switching, lockfile round-trips.
• Store integrity: .store keying/dedup, symlink correctness/repair, .bin shims, cleanup.
• The three latest-branch features under isolated mode: supply-chain security (deny-by-default scripts, allow-remote=none, RFC-868 trusted-identity matching), packageExtensions, and the new .npm-extension transformManifest manifest-repair extension point.

Each sub-task is self-contained, with a minimal reproduction and a side-by-side hoisted comparison.

Sub-tasks

• [BUG] install-strategy=linked: npm install --audit reports "0 vulnerabilities" when a vulnerable package is installed #9609
• [BUG] install-strategy=linked: npm sbom fails with ESBOMPROBLEMS (transitive devDependencies reported missing) #9610
• [BUG] install-strategy=linked: install does not repair a wrong-but-existing symlink target (silently keeps the wrong version) #9611
• [BUG] install-strategy=linked: hidden lockfile (node_modules/.package-lock.json) records the hoisted layout, not the linked layout #9612
• [BUG] install-strategy=linked: .bin shim left dangling after npm uninstall #9613
• [BUG] install-strategy=linked: --workspaces=false and --include-workspace-root fail with invalid filterNode #9614
• [BUG] install-strategy=linked: npm exec -w <ws> ignores a workspace-local bin and falls back to the registry #9616
• [BUG] install-strategy=linked: napi-postinstall cannot resolve an installed optional native binding #9620
• [BUG] install-strategy=linked: .store and stale directories not cleaned up when switching install strategy #9615
• [BUG] install-strategy=linked: npm query ':root > *' reports .store backing paths instead of logical locations #9617
• [BUG] install-strategy=linked: workspace-only / undeclared workspaces are invisible to npm ls and npm query #9618
• [BUG] linked strategy: calcDepFlags produces incorrect dev flags due to multiple Links overwriting target #9100
• [BUG] install-strategy=linked: an applied override is reported invalid by npm ls (exit 1) #9619
• [BUG] install-strategy=linked: npm link <path> (local path) fails with ENOENT in global node_modules #9621
• [BUG] install-strategy=linked: extension-added optional dependency reported UNMET by npm ls though installed #9622
• [BUG] install-strategy=linked: a fresh install reports "up to date" instead of "added N" #9623
• [BUG] install-strategy=linked: Installed transitive optional dependency is not materialized in the actual tree with install-strategy=linked #9627