I have a directory structure like so:
composer.json < Main
packages/
balunker/
testpackage/
composer.json < Package
src/
Composer seems to get confused if the package is already installed from the original repository: it fetches your local repo and refreshes composer.lock from its composer.json but doesn't even try to fetch changes into vendor directory.
Removing it first seems to address it:
composer remove foo/bar
composer require foo/bar @dev