fix(scripts): detect modern bun.lock, ignore stray root lockfiles

[latreon]

Summary

Bun switched its default lockfile from the binary bun.lockb to the text-based bun.lock, but detectFromLockFile() in scripts/lib/package-manager.js only ever checked for bun.lockb — a project using modern Bun would never be detected as using Bun at all.

• Made bun.lock the primary recognized lockfile, kept bun.lockb as a recognized legacy alias via a new lockFileAliases field, and updated detectFromLockFile() to check both.
• Added /bun.lock and /bun.lockb to .gitignore at the repo root — yarn is this repo's canonical package manager (package.json "packageManager"), so a lockfile from someone running bun install locally against this repo shouldn't show up in git status.
• Added a regression test for the modern bun.lock path alongside the existing bun.lockb one.

Test plan

• node tests/lib/package-manager.test.js — 116/116 pass (was 115, added 1 new test)
• node tests/run-all.js — 3111/3111 pass

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e73b27cb-c89a-44e0-aaed-3f05d11d0184

📥 Commits

Reviewing files that changed from the base of the PR and between 754b8dd and 4da4c78.

📒 Files selected for processing (3)

• .gitignore
• scripts/lib/package-manager.js
• tests/lib/package-manager.test.js

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Greptile Review

🧰 Additional context used

📓 Path-based instructions (16)

**/*.{js,ts,jsx,tsx,py,java,cs,go,rb,php,scala,kt}

📄 CodeRabbit inference engine (.cursor/rules/common-coding-style.md)

**/*.{js,ts,jsx,tsx,py,java,cs,go,rb,php,scala,kt}: Always create new objects, never mutate existing ones. Use immutable patterns to prevent hidden side effects and enable safe concurrency
Organize code into many small files (200-400 lines typical, 800 lines max) organized by feature/domain rather than by type
Always handle errors explicitly at every level and never silently swallow errors
Always validate all user input before processing at system boundaries
Use schema-based validation where available
Fail fast with clear error messages when validation fails
Never trust external data (API responses, user input, file content)
Ensure code is readable and well-named
Keep functions small (less than 50 lines)
Keep files focused (less than 800 lines)
Avoid deep nesting (more than 4 levels)
Do not use hardcoded values; use constants or configuration instead

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,jsx,tsx,py,java,cs,rb,go,php,swift,kt,rs,c,cpp,h,hpp}

📄 CodeRabbit inference engine (.cursor/rules/common-security.md)

No hardcoded secrets (API keys, passwords, tokens) - validate before any commit

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,jsx,tsx,py,java,cs,rb,go,php}

📄 CodeRabbit inference engine (.cursor/rules/common-security.md)

**/*.{js,ts,jsx,tsx,py,java,cs,rb,go,php}: All user inputs must be validated
Enable CSRF protection on all state-changing endpoints
Verify authentication and authorization for all protected endpoints
Implement rate limiting on all endpoints to prevent abuse
Ensure error messages do not leak sensitive data in responses

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,jsx,tsx,py,java,cs,rb,go,php,sql}

📄 CodeRabbit inference engine (.cursor/rules/common-security.md)

Use parameterized queries to prevent SQL injection

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,jsx,tsx,html,php,java,cs,rb,go}

📄 CodeRabbit inference engine (.cursor/rules/common-security.md)

Implement XSS prevention by sanitizing HTML output

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,jsx,tsx,py,java,cs,rb,go,php,swift,kt,rs,c,cpp,h,hpp,properties,yml,yaml,json,env,config}

📄 CodeRabbit inference engine (.cursor/rules/common-security.md)

NEVER hardcode secrets in source code - ALWAYS use environment variables or a secret manager

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/typescript-coding-style.md)

**/*.{ts,tsx,js,jsx}: Use spread operator for immutable updates in TypeScript/JavaScript instead of direct mutation
Use async/await with try-catch for error handling in TypeScript/JavaScript
Use Zod for schema-based input validation in TypeScript/JavaScript
No console.log statements in production code; use proper logging libraries instead

**/*.{ts,tsx,js,jsx}: Auto-format JavaScript/TypeScript files using Prettier after edit
Warn about console.log statements in edited files
Check all modified files for console.log statements before session ends

**/*.{ts,tsx,js,jsx}: Use the ApiResponse interface pattern with generic type parameter: interface ApiResponse<T> { success: boolean; data?: T; error?: string; meta?: { total: number; page: number; limit: number; } }
Implement custom React hooks following the pattern: export a named function with use prefix, generic type parameters, and proper useEffect cleanup for side effects

**/*.{ts,tsx,js,jsx}: Never hardcode secrets; always use environment variables for sensitive credentials like API keys
Throw an error when required environment variables are not configured to fail fast and ensure security prerequisites are met

Use Playwright as the E2E testing framework for critical user flows in TypeScript/JavaScript

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{test,spec}.{js,ts,jsx,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/*.{test,spec}.{js,ts,jsx,tsx}: Write tests before implementation (test-driven development); target 80%+ coverage
Achieve minimum 80% test coverage across all three layers: Unit, Integration, and E2E
Use AAA structure (Arrange / Act / Assert) in tests with descriptive test names that explain behavior under test

Files:

• tests/lib/package-manager.test.js

**/*.{js,ts,jsx,tsx}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/*.{js,ts,jsx,tsx}: Always create new objects and never mutate in place; return new copies instead
Keep files between 200–400 lines typical, with a maximum of 800 lines
Extract helpers when a file exceeds 200 lines
Handle errors explicitly at every level; never swallow errors silently
Validate all user input before processing; use schema-based validation where available
Never trust external data (API responses, file content, query params); always validate
All user inputs must be validated and sanitized
Error messages must be scrubbed of sensitive internals
Use readable, well-named identifiers in all code
Keep functions under 50 lines
Keep files under 800 lines
Avoid nesting deeper than 4 levels
Implement comprehensive error handling in all code
Do not hardcode values; use constants or environment configuration instead
Do not use in-place mutation; always return new objects or state

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,jsx,tsx,json,env*}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Do not hardcode secrets, API keys, passwords, or tokens

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/*.{js,ts}: Use parameterized queries for all database writes (no string interpolation)
Auth/authz must be checked server-side for every sensitive path
Rate limiting must be applied to all public endpoints

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{jsx,tsx,js,ts}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

HTML output must be sanitized where applicable

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

**/*.{js,ts,env*}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Required environment variables must be validated at startup

Files:

• tests/lib/package-manager.test.js
• scripts/lib/package-manager.js

{package.json,*.config.js,scripts/**/*.js}

📄 CodeRabbit inference engine (CLAUDE.md)

Package manager detection should support npm, pnpm, yarn, and bun, with configuration via CLAUDE_PACKAGE_MANAGER environment variable or project config.

Files:

• scripts/lib/package-manager.js

scripts/**/*.js

📄 CodeRabbit inference engine (CLAUDE.md)

Ensure cross-platform support for Windows, macOS, and Linux via Node.js scripts in the scripts/ directory.

Files:

• scripts/lib/package-manager.js

{scripts,bin}/**

⚙️ CodeRabbit configuration file

{scripts,bin}/**: Focus on command injection, unsafe subprocess usage, path traversal, SSRF, secret exposure, and missing tests for new CLI behavior.

Files:

• scripts/lib/package-manager.js

🧠 Learnings (1)

📚 Learning: 2026-07-16T15:23:29.177Z

Learnt from: nankingjing
Repo: affaan-m/ECC PR: 2495
File: tests/lib/shell-substitution.test.js:12-24
Timestamp: 2026-07-16T15:23:29.177Z
Learning: In this repository, standalone JavaScript test suites under tests/lib/ follow a local runner convention: they use mutable `passed`/`failed` counters and print per-test console output. During code reviews, treat this as the expected harness style and generally avoid recommending one-off refactors to immutable counters for new/modified suites. Only request such counter refactors if the repository-wide test harness/convention is being changed.

Applied to files:

• tests/lib/package-manager.test.js

🪛 ast-grep (0.44.1)

tests/lib/package-manager.test.js

[warning] 148-148: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(path.join(testDir, 'bun.lock'), '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(detect-non-literal-fs-filename)

🔇 Additional comments (3)

scripts/lib/package-manager.js (1)

46-49: LGTM!

Also applies to: 95-102

.gitignore (1)

102-106: LGTM!

tests/lib/package-manager.test.js (1)

134-143: LGTM!

Also applies to: 146-157

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Improved package manager detection to recognize both modern and legacy Bun lockfiles.
  • Prevented locally generated Bun lockfiles from being tracked when Yarn is the repository’s package manager.

• Tests

  • Added coverage for detecting projects using either Bun lockfile format.

Walkthrough

Bun lockfile handling now recognizes both bun.lock and legacy bun.lockb, updates lockfile scanning to support aliases, ignores both files in Git, and adds detection tests for each format.

Changes

Bun lockfile support

Layer / File(s)	Summary
Lockfile detection and ignore rules .gitignore, scripts/lib/package-manager.js	Bun uses bun.lock as its primary lockfile, retains bun.lockb as an alias, scans both filenames, and ignores both files locally.
Detection coverage tests/lib/package-manager.test.js	Tests verify detection from both the legacy binary and modern text Bun lockfiles.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: affaan-m

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: Bun lockfile detection plus ignoring stray root Bun lockfiles.
Description check	✅ Passed	The description is directly related to the changeset and accurately summarizes the Bun lockfile and .gitignore updates.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR fixes Bun detection in detectFromLockFile() to recognise the modern text-based bun.lock (introduced in Bun 1.1) alongside the legacy binary bun.lockb. The detection logic is clean, and both lockfile variants are covered by tests. The .gitignore additions correctly anchor the ignore rule to the repo root, preserving any sub-package or monorepo use of bun.

• scripts/lib/package-manager.js: promotes bun.lock to the primary lockFile, adds bun.lockb as a lockFileAliases entry, and expands detectFromLockFile() to probe all aliases.
• .gitignore: ignores root-level /bun.lock and /bun.lockb since yarn is this repo's canonical package manager, preventing accidental bun lockfiles from appearing in git status.
• tests/lib/package-manager.test.js: adds a dedicated regression test for bun.lock detection alongside the renamed legacy bun.lockb test.

Confidence Score: 5/5

Safe to merge — the change is a narrow, well-tested detection fix with no side-effects on other package managers.

Both the new lockfile variant and the legacy one are now detected correctly. The lockFileAliases extension point is additive and doesn't touch any other package manager's detection path. The new test directly exercises the changed code path, and all 3111 existing tests continue to pass.

No files require special attention.

Important Files Changed

Filename	Overview
scripts/lib/package-manager.js	Promotes bun.lock as primary lockFile and adds lockFileAliases for backward-compatible bun.lockb detection; logic is correct and concise.
tests/lib/package-manager.test.js	Adds a clean regression test for bun.lock detection; renames the legacy bun.lockb test for clarity.
.gitignore	Adds root-anchored /bun.lock and /bun.lockb ignore entries with a clear explanatory comment; functionally correct.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[detectFromLockFile called] --> B[Iterate DETECTION_PRIORITY\npnpm → bun → yarn → npm]
    B --> C[Build lockFileNames array\nlockFile + lockFileAliases]
    C --> D{Any lockfile\nexists on disk?}
    D -- "bun.lock found (modern)" --> E[return 'bun']
    D -- "bun.lockb found (legacy alias)" --> E
    D -- "yarn.lock found" --> F[return 'yarn']
    D -- "pnpm-lock.yaml found" --> G[return 'pnpm']
    D -- "package-lock.json found" --> H[return 'npm']
    D -- none found --> I[return null]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[detectFromLockFile called] --> B[Iterate DETECTION_PRIORITY\npnpm → bun → yarn → npm]
    B --> C[Build lockFileNames array\nlockFile + lockFileAliases]
    C --> D{Any lockfile\nexists on disk?}
    D -- "bun.lock found (modern)" --> E[return 'bun']
    D -- "bun.lockb found (legacy alias)" --> E
    D -- "yarn.lock found" --> F[return 'yarn']
    D -- "pnpm-lock.yaml found" --> G[return 'pnpm']
    D -- "package-lock.json found" --> H[return 'npm']
    D -- none found --> I[return null]

Loading

_{Reviews (1): Last reviewed commit: "fix(scripts): detect modern bun.lock, ig..." | Re-trigger Greptile}

[daltino]

DECISION: APPROVE

This PR makes focused updates to improve lockfile handling for Bun, aligning with its modern lockfile format while retaining compatibility for legacy files. The addition to .gitignore ensures only the canonical package manager's files are tracked. The updates to the detection logic and tests are thorough and well-structured, adhering to the repo's conventions. Well done!

[haelyra]

Thank you for this! Supporting both the current bun.lock format and the legacy bun.lockb file fixes package-manager detection without changing the existing priority rules. The recorded checks are green, and the combined current-main test run passes in full, so I’m merging it now. We appreciate the careful regression coverage.