Peer-context fixed point never converges on a densely mutually-recursive peer graph (ERR_AUBE_PEER_CONTEXT_NOT_CONVERGED)

[garysassano]

Summary

aube add @deepseek-ai/dsh never reaches a peer-context fixed point and fails with ERR_AUBE_PEER_CONTEXT_NOT_CONVERGED.
npm resolves the same dependency graph without trouble, so the graph itself is satisfiable — the 16-iteration cap is what's being hit.

Reproduction

mkdir /tmp/t && cd /tmp/t && npm init -y
aube add @deepseek-ai/dsh@0.1.0-rc.7

█░░░░░░░░░░░░░░  428/1179 pkgs · resolving
ERROR aube_resolver::peer_context: peer-context hit MAX_ITERATIONS=16 without convergence code="ERR_AUBE_PEER_CONTEXT_NOT_CONVERGED" max_iterations=16
ERR_AUBE_PEER_CONTEXT_NOT_CONVERGED

  × failed to resolve dependencies
  ╰─▶ peer-context fixed-point did not converge after 16 iterations. mutually
      recursive peers, lockfile would be incomplete

Comparison with npm

resolver	result	package count
aube add	fails at iteration 16	climbs past ~1245 before aborting
npm install	succeeds in ~8 min	451 packages, 0 vulnerabilities

The package-count gap looks like the heart of it: npm flattens and dedupes, while aube duplicates per peer context to build the virtual store, so this graph's context count keeps growing instead of settling.

Why this graph is hard

@deepseek-ai/dsh has ~60 direct @deepseek-ai/dsh-* dependencies, and each of those declares peer dependencies on a dozen more siblings, which peer-depend back. For example @deepseek-ai/dsh-goal peer-depends on dsh-llm, dsh-agent, dsh-brand, dsh-scope, dsh-session, dsh-invariants, dsh-typert-protocol and dsh-session-projection, several of which peer-depend on dsh-goal's other peers in turn.

The sibling ranges are carets on prereleases (^0.1.0-rc.7), which resolve as >=0.1.0-rc.7 <0.2.0. Now that rc.6, rc.7 and rc.8 are all published, those ranges span three prereleases simultaneously across all ~60 packages.

This appears to be what tips it over rather than any single release: rc.6 installed successfully back when it was the newest prerelease, but re-resolving @deepseek-ai/dsh@0.1.0-rc.6 from scratch today fails identically. All of rc.6, rc.7 and rc.8 now fail the same way.

Workarounds tried, none effective

Each was set in an isolated project's .npmrc with node_modules and the lockfile removed in between; all four fail with the identical error.

• auto-install-peers=false
• dedupePeers=true
• strict-peer-dependencies=false
• peerDependencyRules.allowAny=true

MAX_ITERATIONS does not appear to be exposed as a setting, so there's no way to raise the cap for a graph that may simply need more iterations.

Suggestions

Making the iteration cap configurable would at least give an escape hatch for pathological graphs.
Beyond that, it would help to know whether this graph is genuinely non-convergent or merely slow to converge — the error reports the cap but not whether the context set was still changing when it gave up, which would distinguish "needs more iterations" from a true cycle.
If it is a true cycle, naming the mutually recursive packages in the diagnostic would make it actionable for the package author instead of a dead end for the user.

Environment

• aube 1.41.0 linux-x64 (2026-08-16), invoked via mise 2026.8.9
• Node v24.19.0
• Linux 6.18.33.2-microsoft-standard-WSL2

[jdx]

Thanks for the detailed report. I confirmed this is a finite deep peer chain rather than a genuinely divergent graph.

The exact @deepseek-ai/dsh@0.1.0-rc.7 reproduction succeeds on current main: the peer-context pass converges after 23 iterations and produces 451 packages. The failure in v1.41.0 is the fixed 16-iteration ceiling.

This was already addressed by #1324, which merged just after the v1.41.0 tag. The limit now scales with the number of peer-bearing packages, with a 16-iteration floor and 256-iteration safety ceiling. The fix is included in the upcoming v1.42.0 release PR.

The ~1190 count shown during resolution is traversal progress, not the final contextualized package count, so the gap from npm is not evidence that contexts grow indefinitely here.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.