Hoist may delete certain packages from the packages folder during bootstrap

Today I ran into one of the worst things a software can do because a bug: fail destructively.

I recently started to use hoist to save lot of startup time and space during development. However I find a situation where hoist behaves destructively, which should never happen in this kind of tool. Luckly git (specifically VSCode git interface) show me a bunch of deleted files in a bright red that took my attention. This may be the result of a mixture of uncommon variables:

• I wanted to hoist certain local packages, so I added the root of the repo to the packages array
• There is a mismatch on the package version and the packages that depend on it

Expected Behavior

I expected lerna to warn me some way, instead of deleting my package and fail with a long and unreadable stack trace

Current Behavior

The package is deleted and sometimes bootstrap fails, and other times it succeeds. Very erratic

Steps to Reproduce (for bugs)

1. On a lerna repo in lerna.json add “.” to the array of packages
2. Make one package with a version, let’s say 0.2.4
3. Add one or two more packages depending on the first one but with a different version than the current one, fort example 0.2.2
4. Add hoist: true to lerna.json or add the option during the bootstrap command
5. Execute lerna bootstrap

{
  "lerna": "2.0.0",
  "packages": [
    ".",
    "src/*"
  ],
  "hoist": true,
  "registry": "https://tools.caseonit.com/npm",
  "commands": {
    "publish": {
      "conventionalCommits": true,
      "message": "chore: Publish"
    }
  },
  "version": "independent"
}

lerna-debug.log

No lerna-debug is generated

Your Environment

Executable	Version
lerna --version	2.0.0
npm --version	4.1.2
node --version	7.7.1

OS	Version
MacOSX	El Capitan

[evocateur]

TL;DR: Don’t use lerna bootstrap. Yarn workspaces, pnpm recursive, and npm workspaces (whenever they’re released, lol) should be more than sufficient.

[piperchester]

Similar to @daffl - we have a monorepo with 80+ packages. I major bumped one of the packages (let’s say A) from v1 to v2 locally (before it’s been deployed to be installed by).

Two other packages (B and C) depend on v1.x of A. So the root package structure might look like

root/packages/A # v2.0
root/packages/B # A@v1.0
root/packages/C # A@v1.0

When I run lerna bootstrap --hoist, A is deleted:

root/packages/B # A@v1.0
root/packages/C # A@v1.0

And B and C’s package-lock.json remains the same. I suspect because B and C’s dependence on v1 take precedence over the newly versioned v2.

Has anyone experienced similar behavior to this?

Edit: lerna run clean may solve this issue.