fix(npm-globals): purge bun npm shim that breaks @railway/cli install - #2022
Conversation
The npm 'bun' wrapper package gets pulled in as a transitive dependency. When its postinstall is skipped, it leaves a broken stub at .bin/bun that shadows the real system bun, causing every subsequent postinstall that shells out to bun to fail (e.g. @railway/cli). Add purge_bun_npm_shim() that removes the bun npm package and its .bin shims after every bun add/install operation.
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Warning Review limit reached
Next review available in: 48 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a purge_bun_npm_shim function in install-npm-globals.sh to remove the npm "bun" wrapper package and its shims from global node_modules, preventing them from shadowing the system bun. It also adds corresponding tests in npm_globals_spec.sh. Feedback was provided to make the purge check more robust by also checking for dangling symlinks (-L or -e) in case the main directory is missing but the shims remain.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| # subsequent postinstall that shells out to bun (e.g. @railway/cli). | ||
| purge_bun_npm_shim() { | ||
| local gm="${HOME}/.bun/install/global/node_modules" | ||
| if [ -d "${gm}/bun" ]; then |
There was a problem hiding this comment.
If a previous run was interrupted, or if the ${gm}/bun directory was deleted/cleaned up but the shims in ${gm}/.bin were left behind, they will become dangling symlinks.
In Unix-like systems, a dangling symlink in a directory that is in the PATH (like node_modules/.bin during postinstall scripts) will still shadow the command and cause execution to fail with a No such file or directory error, rather than falling back to the real system bun.
Since the current check only looks for the directory [ -d "${gm}/bun" ], it will skip purging the shims if the directory is gone but the dangling symlinks remain.
To make this robust against dangling symlinks, we should also check for the existence of the symlinks/files themselves using [ -L ... ] and [ -e ... ].
| if [ -d "${gm}/bun" ]; then | |
| if [ -d "${gm}/bun" ] || [ -L "${gm}/.bin/bun" ] || [ -L "${gm}/.bin/bunx" ] || [ -e "${gm}/.bin/bun" ] || [ -e "${gm}/.bin/bunx" ]; then |
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| rm -f "${gm}/.bin/bun" "${gm}/.bin/bunx" | ||
| echo "Removed broken bun npm shim from global node_modules" | ||
| fi | ||
| } |
There was a problem hiding this comment.
Purge doesn't cover ~/.bun/bin for later phases: home-manager/modules/npm-globals/default.nix puts $HOME/.bun/bin on home.sessionPath, and bun add -g on the wrapper package creates ~/.bun/bin/bun as a symlink into install/global/node_modules/bun/.... This function only deletes the target under install/global/node_modules, so ~/.bun/bin/bun becomes a dangling symlink. The dangling-shim sweep at lines 224–232 catches it, but it runs once — before the purges at lines 242 and 340. If either the overrides bun install or the optional-native bun add --global re-materializes the wrapper, ~/.bun/bin/bun is left dangling until the next script run.
Today this is not immediately harmful because bash's test -x returns false on dangling symlinks and PATH resolution falls through to the Nix bun. But it relies on bash-specific PATH semantics; interactive shells with a cached hash bun, or non-bash callers, may still resolve to the dead symlink and reproduce the original shadow. Consider extending the purge to also rm -f "${HOME}/.bun/bin/bun" "${HOME}/.bun/bin/bunx" (or moving the dangling sweep to run after every purge).
| When run bash -c "grep -A 1 'bun add --global.*dep.*2>/dev/null' '$SCRIPT' | grep 'purge_bun_npm_shim'" | ||
| The output should include 'purge_bun_npm_shim' | ||
| End | ||
| End |
There was a problem hiding this comment.
Behavior not exercised by tests: These four cases only grep the source file for literal strings (purge_bun_npm_shim(), rm -rf.*gm.*bun, rm -f.*\.bin/bun, bun add --global.*dep.* → purge_bun_npm_shim). They pass whenever those tokens appear in the file, regardless of whether the purge actually fires or removes the wrapper.
The file already has good precedent for real integration tests — see native-binary reinstall integration (line 251) and stale global package pruning (line 318). A similar block that seeds $TEMP_HOME/.bun/install/global/node_modules/bun/package.json and asserts it's gone after running the script would actually guard the fix from regressing.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="spec/npm_globals_spec.sh">
<violation number="1" location="spec/npm_globals_spec.sh:191">
P3: These tests only verify that certain string patterns exist in the source file (via `grep`). They'll pass as long as the tokens are present, regardless of whether the purge logic actually removes the wrapper correctly. The spec file already has good integration-style precedents (e.g. `native-binary reinstall integration` at line 251) — a test that seeds a fake `bun/package.json` under a temp global modules dir and asserts it's gone after sourcing/running the function would provide real regression protection.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| End | ||
|
|
||
| Describe 'bun npm shim purge' | ||
| It 'defines a purge_bun_npm_shim function' |
There was a problem hiding this comment.
P3: These tests only verify that certain string patterns exist in the source file (via grep). They'll pass as long as the tokens are present, regardless of whether the purge logic actually removes the wrapper correctly. The spec file already has good integration-style precedents (e.g. native-binary reinstall integration at line 251) — a test that seeds a fake bun/package.json under a temp global modules dir and asserts it's gone after sourcing/running the function would provide real regression protection.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At spec/npm_globals_spec.sh, line 191:
<comment>These tests only verify that certain string patterns exist in the source file (via `grep`). They'll pass as long as the tokens are present, regardless of whether the purge logic actually removes the wrapper correctly. The spec file already has good integration-style precedents (e.g. `native-binary reinstall integration` at line 251) — a test that seeds a fake `bun/package.json` under a temp global modules dir and asserts it's gone after sourcing/running the function would provide real regression protection.</comment>
<file context>
@@ -187,6 +187,28 @@ The output should include 'find'
End
+Describe 'bun npm shim purge'
+ It 'defines a purge_bun_npm_shim function'
+ When run bash -c "grep 'purge_bun_npm_shim()' '$SCRIPT'"
+ The output should include 'purge_bun_npm_shim'
</file context>
1 participant
Summary
bunwrapper package gets pulled in as a transitive dependency during global installs.bin/bunthat shadows the real system bunbunto fail (e.g.@railway/cli, and likely the other 12 failing packages)purge_bun_npm_shim()that removes the broken bun npm package and its.binshims after everybun add/bun installoperationTest plan
install-npm-globals.shand verify@railway/cliinstalls successfullySummary by cubic
Fixes global installs failing due to a broken npm
bunshim that shadowed the systembun, blocking@railway/cliinstalls. We now remove the npmbunwrapper and its.binshims after each global install step.purge_bun_npm_shim()to delete the npmbunwrapper and.bin/bun/bunxshims from the global install.bun add --global, and after applying global overrides.Written for commit 86389fb. Summary will update on new commits.