install: remove node_modules entries that left the lockfile - #32974
Open
robobun wants to merge 13 commits into
Open
install: remove node_modules entries that left the lockfile#32974robobun wants to merge 13 commits into
robobun wants to merge 13 commits into
Claude / Claude Code Review
completed
Jun 28, 2026 in 24m 12s
Code review found 2 important issues
Found 5 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/install/isolated_install.rs:1984-2006 |
Isolated prune deletes publicHoistPattern hoists under --filter |
| 🔴 Important | src/install/hoisted_install.rs:262-273 |
Global install prune deletes bun link registrations |
Annotations
Check failure on line 2006 in src/install/isolated_install.rs
claude / Claude Code Review
Isolated prune deletes publicHoistPattern hoists under --filter
Under the isolated linker, the kept set unions `root_pkg_deps` (flag-independent) with `entry_dependencies[ROOT]`, but the latter is built by the store pass that calls `is_filtered_dependency_or_workspace` and so is narrowed by `--filter`. A `publicHoistPattern` hoist that comes from a filtered-out workspace's transitive is therefore in neither set, and `bun install --filter=...` deletes it from the root `node_modules` even though the full lockfile still places it there. The hoisted linker avoid
Check failure on line 273 in src/install/hoisted_install.rs
claude / Claude Code Review
Global install prune deletes bun link registrations
The prune is not gated on `!this.options.global`, so any `bun add -g <pkg>` / `bun install -g` chdirs to the global install dir and prunes `<global_dir>/node_modules`. `bun link` (no args) creates a bare symlink there without touching the global package.json/lockfile, so the linked name is never in `expected_root_entries` and gets `delete_tree`'d — every `bun link` registration (and its global bin shim, via the follow-on `prune_dangling_bin_links`) is silently destroyed by the next global instal
Loading