Make binary intsallation behavior more sensible

[cometkim]

What version of Bun is running?

1.0.9

What platform is your computer?

Linux 6.2.0-36-generic x86_64 x86_64

What steps can reproduce the bug?

bun add vite

# expect this to be failed
bun esbuild --version

bun remove vite

# expect this to be failed
bun esbuild --version

Do same test for global

What is the expected behavior?

Vite package has the vite binary in its manifest, and 3 other binaries esbuild, rollup, nanoid from its transitive dependencies.

Users expect only vite command available after installation, especially when it is for global installation.

What do you see instead?

Bun installs all binaries from transitive dependencies. So vite, esbuild, rollup, nanoid commands are available.

And even Bun doesn't cleanup transitive binaries after uninstalling vite, so even after uninstallation esbuild, rollup, nanoid commands are available. The only option for cleanup is to remove and regenerate node_modules, and this is not possible for global installation.

Additional information

https://gist.github.com/cometkim/eb2842d67b40e583e4886e9b897a6af0

[Electroid]

So this does match the behaviour of npm and yarn, but I can see the argument to not do this.

Also, this is seperate bug:

Bun doesn't cleanup transitive binaries after uninstalling

[cometkim]

So this does match the behaviour of npm and yarn, but I can see the argument to not do this.

no. yarn and pnpm don't allow execution of binaries from transitive dependencies. Only vite is available when installing Vite.

[cometkim]

Yarn and PNPM are intentionally incompatible with NPM's bad behaviors around transitive dependencies

• It is non-deterministic. When transitive dependencies B and C declare the same bin: foo, which should be resolved?
• It causes unintended installation by the user. So it could be vulnerable to supply chain attacks.
• It bloats shell completions. Users will see a list of bins that have never installed.