socket npm install/uninstall removes optional peer entries from package-lock.json

Start by tracing the incremental socket npm install and socket npm uninstall paths that update package-lock.json, then compare their handling of entries marked both "optional": true and "peer": true with the from-scratch lockfile path. The issue does not name source files or tests, so locate those entry points and their lockfile tests in the repository. Done means unrelated incremental operations retain these entries and npm ci rejects a lockfile missing required peer entries, consistently with npm.

Summary

Incremental socket npm install <pkg> and socket npm uninstall <pkg> remove every
package-lock.json entry flagged "optional": true, "peer": true (a package present only
to satisfy a peer dependency of an optional dependency). The removal occurs regardless of
which package is installed or uninstalled.

• Real npm, same operation: entries retained.
• From-scratch generation (socket npm install --package-lock-only with no lockfile): not
  affected.
• npm ci on the result: EUSAGE, Missing: <pkg> from lock file.
• socket npm ci on the result: exits 0 and installs the tree without the peer.

Expected vs. actual

	Expected (matches npm)	Actual (socket npm)
Lockfile after install / uninstall of an unrelated package	"optional": true, "peer": true entries retained	Entries removed
socket npm ci on a lockfile missing those entries	Fails with EUSAGE, as npm ci does	Exits 0 and installs the tree without the peer

Environment

Component	Version
Socket CLI	1.12.1 (latest, 2026-10-29); also reproduced on 1.1.94
npm (wrapped by socket npm, and standalone)	11.16.0; also reproduced on 11.19.1 (CLI 1.1.94)
Socket Firewall	sfw Free 1.15.4, 1.15.6
Node	24.22.1
OS / arch	Linux arm64 (OrbStack)
Registry	https://registry.npmjs.org/
Socket auth	none (token: (not set))

Minimal reproduction

package.json:

{
  "name": "repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": { "@fontsource/ibm-plex-mono": "^5.3.0" },
  "optionalDependencies": { "react-dom": "18.3.1" }
}

[email protected] declares peerDependencies: { "react": "^18.3.1" }. npm records react
with "optional": true, "peer": true.

# 1. Baseline lockfile (real npm)
npm install --package-lock-only
grep -c '"peer": true' package-lock.json        # 1 (react)

# 2. Uninstall an unrelated package via the Socket CLI
socket npm uninstall @fontsource/ibm-plex-mono --package-lock-only
grep -c '"peer": true' package-lock.json        # 0

# 3. npm ci (real npm)
npm ci --dry-run
# npm error code EUSAGE
# npm error Missing: [email protected] from lock file

# 4. sfw npm ci
sfw npm ci --dry-run                            # EUSAGE, Missing: [email protected]

# 5. socket npm ci
socket npm ci --ignore-scripts                  # exit 0, "added 4 packages"
ls node_modules                                 # js-tokens loose-envify react-dom scheduler

Controls:

• Step 2 with real npm (npm uninstall @fontsource/ibm-plex-mono --package-lock-only):
  react retained; npm ci passes.
• Step 2 as socket npm install @fontsource/inter --package-lock-only: react removed;
  same result as uninstall.

Test matrix

Method:

• Baseline lockfile generated with real npm; the Socket CLI performs only the incremental
  operation.
• Operations: uninstall @fontsource/ibm-plex-mono, install @fontsource/inter. Neither
  touches the peer packages.
• Validation of the Socket-produced lockfile: npm ci --dry-run, sfw npm ci --dry-run,
  socket npm ci --ignore-scripts.
• 2 runs per case and operation; all runs identical.

Socket CLI 1.12.1, npm 11.16.0, sfw 1.15.6:

Case	Peer entry flags (baseline)	socket npm install / uninstall	npm install / uninstall	npm ci	sfw npm ci	socket npm ci
react-dom direct	peer	retained	retained	pass	pass	pass
react-dom + react direct	none	retained	retained	pass	pass	pass
react-dom optional	peer, optional	removed	retained	fail	fail	pass
@napi-rs/wasm-runtime direct	peer	retained	retained	pass	pass	pass
@napi-rs/wasm-runtime + @emnapi/* direct	none	retained	retained	pass	pass	pass
@napi-rs/wasm-runtime optional	peer, optional	removed	retained	fail	fail	pass

• fail = EUSAGE, Missing: <peer> from lock file.
• CLI 1.1.94: install/uninstall columns identical on npm 11.16.0 and 11.19.1;
  socket npm ci exit 0 on the broken react-dom lockfile.

Excluded factors:

Factor	Evidence
Peer dependency alone	peer-only entries retained (rows 1, 4)
Specific package	Reproduces with react and @emnapi/*
Prerelease versions	Removed @emnapi/core is stable 1.11.3
npm version skew	Wrapped and standalone npm identical in each run
Outdated CLI	Reproduces on latest release 1.12.1

Original occurrence

• Project: Astro site, July 2026.
• Path: astro → build tooling → @napi-rs/[email protected] (optional) → peer
  @emnapi/core ^2.0.0-alpha.3, @emnapi/runtime ^2.0.0-alpha.3.
• No other dependent on @emnapi/* 2.x, so @emnapi/core, @emnapi/runtime and
  @emnapi/wasi-threads were peer + optional entries.
• Trigger: socket npm install (3 packages), then socket npm uninstall (2 packages).
  All three entries removed; CI npm ci failed.
• Current resolution of the same package.json does not reproduce: a newer astro
  dependency requires @emnapi/[email protected] directly, so the entries are no longer
  peer-only.
• Reproduces with dependencies resolved as of that date:
  npm install --package-lock-only --before=2026-07-30.

Impact

Command	Result on the affected lockfile
npm ci	fail — EUSAGE, Missing: <peer> from lock file
sfw npm ci	fail — same error
socket npm ci	pass — installs the tree without the peer

• The CLI produces the inconsistent lockfile and also passes it on ci. With npm
  aliased to socket npm, local npm ci, npm ci --dry-run and builds all pass; the
  failure surfaces only in environments running real npm (CI).
• sfw delegates to real npm and is unaffected: it rejected every broken lockfile in the
  matrix.

Related

Not re-verified since the original occurrence. From-scratch lockfiles from the Socket CLI
omitted libc fields that npm records on platform-specific packages:

       "cpu": [ "arm64" ],
+      "libc": [
+        "glibc"
+      ],
       "optional": true,

No effect on npm ci validation. Output is not byte-identical to npm's.

Not tested

• Mechanism (only the effect is observed).
• Authenticated CLI, org policies.
• Peers optional via peerDependenciesMeta rather than via an optional dependency.

Questions

1. Does the incremental path rebuild the ideal tree, or edit the existing lockfile in
   place? In-place handling that treats "optional": true, "peer": true entries as
   removable would match the observed behaviour.
2. Why does socket npm ci accept a lockfile that npm ci rejects? This divergence hides
   the defect until CI.
3. Is the omission of libc fields intentional?

Workaround

Generate and validate lockfiles with real npm, bypassing the wrapper:

/usr/bin/npm install --package-lock-only
/usr/bin/npm ci        # must pass before commit

sfw npm ci is safe locally and in CI; it does not alter npm's behaviour.