Skip to content

install: remove node_modules entries that left the lockfile - #32974

Open
robobun wants to merge 13 commits into
mainfrom
claude/farm/4f23685c/prune-stale-node-modules
Open

install: remove node_modules entries that left the lockfile#32974
robobun wants to merge 13 commits into
mainfrom
claude/farm/4f23685c/prune-stale-node-modules

key the prune to each linker's root placements and sweep dangling .bi…

620efef
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Jun 28, 2026 in 24m 12s

Code review found 2 important issues

Found 5 candidates, confirmed 2. See review comments for details.

Details

Severity Count
🔴 Important 2
🟡 Nit 0
🟣 Pre-existing 0
Severity File:Line Issue
🔴 Important src/install/isolated_install.rs:1984-2006 Isolated prune deletes publicHoistPattern hoists under --filter
🔴 Important src/install/hoisted_install.rs:262-273 Global install prune deletes bun link registrations

Annotations

Check failure on line 2006 in src/install/isolated_install.rs

See this annotation in the file changed.

@claude claude / Claude Code Review

Isolated prune deletes publicHoistPattern hoists under --filter

Under the isolated linker, the kept set unions `root_pkg_deps` (flag-independent) with `entry_dependencies[ROOT]`, but the latter is built by the store pass that calls `is_filtered_dependency_or_workspace` and so is narrowed by `--filter`. A `publicHoistPattern` hoist that comes from a filtered-out workspace's transitive is therefore in neither set, and `bun install --filter=...` deletes it from the root `node_modules` even though the full lockfile still places it there. The hoisted linker avoid

Check failure on line 273 in src/install/hoisted_install.rs

See this annotation in the file changed.

@claude claude / Claude Code Review

Global install prune deletes bun link registrations

The prune is not gated on `!this.options.global`, so any `bun add -g <pkg>` / `bun install -g` chdirs to the global install dir and prunes `<global_dir>/node_modules`. `bun link` (no args) creates a bare symlink there without touching the global package.json/lockfile, so the linked name is never in `expected_root_entries` and gets `delete_tree`'d — every `bun link` registration (and its global bin shim, via the follow-on `prune_dangling_bin_links`) is silently destroyed by the next global instal